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Executive  Summary 


Traditional  insider  threat  management  involves  practices  that  constrain  users,  monitor  their  be¬ 
havior,  and  detect  and  punish  misbehavior.  Such  negative  incentives  attempt  to  force  employees 
to  act  in  the  interests  of  the  organization  and,  when  relied  on  excessively,  can  result  in  negative 
unintended  consequences  that  exacerbate  the  threat. 

Positive  incentives  can  complement  traditional  practices  by  encouraging  employees  to  act  in  the 
interests  of  the  organization  either  extrinsically  (e.g.,  through  rewards  and  recognition)  or  intrinsi¬ 
cally  by  fostering  a  sense  of  commitment  to  the  organization,  the  work,  and  co-workers.  Instead 
of  solely  focusing  on  making  sure  employees  don’t  misbehave,  positive  incentives  create  a  work 
environment  where  employees  are  internally  driven  to  contribute  to  the  organization  only  in  posi¬ 
tive  ways.  Preliminary  evidence  suggests  that  positive  incentives  can  deter  insider  misbehavior  in 
a  constructive  way  from  the  outset  of  the  employee-organization  relationship  with  fewer  negative 
consequences  than  traditional  practices  alone. 

This  report  describes  the  results  of  an  internally  funded  exploratory  research  project  at  the  Soft¬ 
ware  Engineering  Institute  (SEI)  to  assess  the  potential  for  positive  incentives  to  complement  tra¬ 
ditional  practices  in  a  way  that  provides  a  better  balance  for  organizations’  insider  threat  pro¬ 
grams. 

We  believe  there  are  three  dimensions  along  which  we  can  positively  align  an  employee’s  inter¬ 
ests  with  their  employer’s  interests:  the  employee’s  job,  their  organization,  and  the  people  they 
work  with. 

•  Job  Engagement  involves  the  extent  to  which  employees  are  excited  by  and  absorbed  in  their 
work.  Strengths-based  management  and  professional  development  are  practices  known  to 
boost  employee  job  engagement.  Strengths-based  management  focuses  primarily  on  identify¬ 
ing  and  using  an  individual’s  personal  and  professional  strengths  in  managing  both  their  ca¬ 
reer  and  job  performance  [Buckingham  2009]. 

•  Perceived  Organizational  Support  involves  the  extent  to  which  employees  believe  their  or¬ 
ganization  values  their  contributions,  cares  about  their  well-being,  supports  their  socio-emo- 
tional  needs,  and  treats  them  fairly.  Here,  programs  promoting  flexibility,  work/family  bal¬ 
ance,  employee  assistance,  alignment  of  compensation  with  industry  benchmarks,  and 
constructive  supervision  that  attends  to  employee  needs  can  boost  perceived  organizational 
support. 

•  Connectedness  at  Work  involves  the  extent  to  which  employees  trust,  feel  close  to,  and 
want  to  interact  with  the  people  with  whom  they  work.  Practices  involving  team  building  and 
job  rotation  can  boost  employees’  sense  of  interpersonal  connectedness. 

There  has  been  extensive  previous  research  in  these  areas  that  demonstrate  their  value  in  terms  of 
employee  satisfaction,  commitment,  performance,  and  retention.  In  addition,  a  related  body  of  re¬ 
search  exists  that  helps  determine  the  value  of  these  dimensions  in  reducing  counterproductive 
work  behaviors  generally.  The  SEI’s  research  aims  to  bolster  the  evidence  that  interest-alignment 
practices  reduce  the  more  egregious  forms  of  cyber-related  insider  threat,  such  as  employee  infor¬ 
mation  theft  and  cyber  sabotage. 
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In  summary,  this  report  describes  our  research,  analysis,  and  results  in  several  areas: 

•  Analyzing  several  high-profile  insider  incidents  for  the  levels  of  job  engagement,  co-worker 
connectedness,  and  perceived  organization  support  evident  during  the  incident  timeline.  Per¬ 
ceived  organizational  support  was  found  to  be  low,  but  not  necessarily  in  the  extreme.  These 
incident  case  studies  suggested  focusing  on  organizational  support  in  our  survey  research. 

•  Conducting  a  survey  of  individuals  responsible  for  establishing  insider  threat  programs  in 
organizations.  Supporting  and  extending  previous  research,  we  found  a  negative  correlation 
between  perceived  organizational  support  and  intentional  (primarily  malicious)  counterpro¬ 
ductive  work  behaviors.  A  somewhat  weaker  negative  correlation  was  also  found  between  or¬ 
ganizational  justice  and  these  behaviors.  The  relationships  were  found  to  be  statistically  sig¬ 
nificant  at  the  95%  confidence  level.  However,  the  exploratory  nature  of  our  initial  analysis 
does  not  permit  us  to  generalize  this  relationship  to  the  larger  population  of  organizations. 

•  Developing  a  simulation  model  that  illustrates  the  value  of  positive  incentives.  We  developed 
a  system  dynamics  model  based  on  published  data  and  simple  (but  arguable)  assumptions 
showing  how  positive  incentives  can  increase  a  program’s  operational  efficiency  with  re¬ 
duced  investigative  costs  and  fewer  incidents  involving  disgruntled  or  exploitive  insiders.  Our 
incident  analysis  and  survey  work  provided  validation  of  the  simulation  model  structure.  We 
will  continue  to  calibrate  our  model  based  on  future  research  and  expect  to  demonstrate  simi¬ 
lar  benefits  as  our  work  progresses. 

Our  research  raises  many  questions  about  how  an  insider  threat  program  can  or  should  incorporate 
positive  incentives  that  improve  employees’  perceptions  of  support  by  the  organization.  In  addi¬ 
tion  to  research  to  understand  whether  the  surveyed  relationships  generalize  and  are  causal  in  na¬ 
ture,  our  future  work  will  focus  on  what  we  believe  to  be  the  key  to  a  successful  insider  threat 
program:  identifying  the  mix  of  positive  and  negative  incentives  that  creates  a  net  positive  for 
both  the  employee  and  the  organization. 

The  challenge  is  that  people  respond  to  incentives  differently  depending  on  the  culture  of  the  or¬ 
ganization,  the  nature  of  their  job,  and  their  personality.  Fortunately,  existing  theory  provides  in¬ 
sight  into  these  differences  and  can  illuminate  a  means  for  building  a  general  transition  process  to 
take  an  organization  from  its  current  state  to  one  that  has  a  balance  of  positive  and  negative  incen¬ 
tives  that  promotes  employee  satisfaction,  performance,  and  retention  while  also  being  more  ef¬ 
fective  at  reducing  the  insider  threat. 
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Abstract 


Traditional  insider  threat  practices  involve  negative  incentives  that  attempt  to  force  employees  to 
act  in  the  interests  of  the  organization  and,  when  relied  on  excessively,  can  result  in  negative  un¬ 
intended  consequences  that  exacerbate  insider  threats.  Positive  incentives  that  attempt  to  encour¬ 
age  employees  to  act  in  the  interests  of  the  organization  can  complement  negative  incentives.  In 
our  research,  we  identified  and  analyzed  three  avenues  for  aligning  the  interests  of  the  employee 
and  the  organization:  job  engagement,  perceived  organizational  support,  and  connectedness  with 
co-workers.  Based  on  an  analysis  of  three  insider  threat  incidents  and  an  exploratory  survey  of  or¬ 
ganizations,  we  developed  a  model  of  the  disgruntled  insider  threat  problem  as  it  relates  to  dissat¬ 
isfaction  with  the  employing  organization  and  the  potential  benefits  associated  with  positive  in¬ 
centives  that  improve  perceived  organizational  support  and  justice.  To  help  organizations 
understand  their  options  for  using  positive  incentives  as  part  of  their  insider  threat  program,  we 
outline  workforce  management  practices  to  improve  employees’  feelings  of  being  supported  by 
the  organization.  This  research  is  a  first  step  toward  creating  a  well-grounded  foundation  on 
which  insider  threat  programs  can  establish  a  more  balanced  and  effective  means  of  reducing  in¬ 
sider  threats,  one  that  is  a  net  positive  for  both  the  employee  and  the  organization. 
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VII 


1  Introduction 


Traditional  guidance  regarding  how  to  defend  against  insider  threats  focuses  primarily  on  nega¬ 
tive  incentives,  which  constrain  employee  behavior  or  detect  and  punish  misbehavior.  These  tradi¬ 
tional  security  practices  are  necessary  to  reduce  insider  threats,  but  their  excessive  use  can  result 
in  counterproductive  constraints  on  employees’  actions,  overreliance  on  after-the-fact  responses 
that  fail  to  prevent  damage,  and  alienation  of  staff  that  can  exacerbate  insider  threats  [Moore 
2015], 

Fortunately,  traditional  practices  are  only  part  of  the  suite  of  management  practices  that  organiza¬ 
tions  have  available  to  reduce  insider  threats.  Figure  1  provides  an  abstract  view  of  the  spectrum 
of  insider  threat  countermeasures,  with  more  abstract  objectives  to  the  right  and  the  means  for 
achieving  them  to  the  left. 

The  bulk  of  insider  threat  research  has  focused  on  the  bottom  two  branches:  the  prevention,  detec¬ 
tion  of,  and  response  to  insider  misbehaviors.  Security  policies  and  technical  measures  provide 
negative  incentives  that  are  intended  to  prevent,  detect,  and  respond  to  insider  misbehavior.  Re¬ 
cent  research  has  focused  on  the  detection  of  at-risk  behaviors  of  insiders,  such  as  conflict  with 
co-workers  or  personal  indebtedness,  which  have  been  shown  to  be  pre-cursors  of  serious  insider 
threat  activity  (the  third  branch). 

The  research  described  in  this  report  involves  the  top  branch:  positive  incentives  as  a  means  to  re¬ 
duce  insider  threats  without  the  use  of  monitoring  and  detection  mechanisms.  Positive  incentives 
can  complement  traditional  practices  by  encouraging  employees  to  act  in  the  interests  of  the  or¬ 
ganization  either  extrinsically  (e.g.,  through  rewards  for  following  security  policies)  or  intrinsi¬ 
cally  by  fostering  a  sense  of  commitment  to  the  organization,  the  work,  and  co-workers. 
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A  few  forward-thinking  sources  make  the  case  that  positive  incentives  are  a  significant  missing 
aspect  of  insider  threat  defense  [Bunn  2014,  DSS  2016,  CPNI 2014,  Theoharidou  2005,  Sarbin 
1994].  Instead  of  solely  focusing  on  making  sure  employees  don’t  misbehave,  positive  incentives 
create  a  work  environment  where  employees  are  internally  driven  to  contribute  to  the  organization 
only  in  positive  ways.  This  approach  may  seem  idealistic,  but  there  is  a  solid  scientific  basis  for 
this  perspective.  Our  research  is  making  inroads  into  the  second  branch  of  Figure  1  by  elaborating 
conditions  within  organizations  that  are  conducive  to  insider  threat  and  a  means  for  transforming 
organizations  to  be  more  resistant  to  insider  threats.  Preliminary  evidence  suggests  that  positive 
incentives  can  deter  insider  misbehavior  in  a  constructive  way  from  the  outset  of  the  employee- 
organization  relationship.  In  combination  with  traditional  practices,  positive  incentives  offer  the 
possibility  of  a  more  balanced  and  constructive  organizational  approach  to  reducing  the  insider 
threat  with  fewer  negative  consequences. 

This  report  describes  the  results  of  a  research  effort  to  establish  and  model  the  influence  of  posi¬ 
tive  incentives  on  reducing  insider  threats.  For  U.S.  Government  organizations  and  their  contrac¬ 
tors  that  handle  classified  information,  Executive  Order  13587  requires  establishing  formal  insider 
threat  programs.  Many  non-governmental  organizations  are  also  establishing  insider  threat  pro¬ 
grams  as  a  means  to  reduce  their  risk  of  insider  theft,  fraud,  and  sabotage.  With  organizations 
starting  to  recognize  the  downsides  of  negative  incentives,  the  need  for  this  research  has  never 
been  more  pressing.  It  can  be  a  means  to  prevent  employee  alienation  from  their  employer  that 
can  spur  insider  threats,  and  to  complement  organizational  detection  and  response  capabilities. 

1.1  Research  Context 

The  subject  of  our  research  intersects  issues  important  to  both  human  resources  (FIR)  and  cyberse¬ 
curity  professionals.  Appendix  A  provides  the  larger  landscape  of  our  research  as  a  focus  on 
early-stage  disincentivization  of  insider  threats  using  positive  incentives  that  benefit  both  the  em¬ 
ployee  and  the  organization.  We  identify  two  types  of  workforce  management  practices  relevant 
in  our  research: 

•  Negative  incentive-based  practices  (negative  incentives,  for  short):  workforce  management  prac¬ 
tices  that  attempt  to  force  employees  to  act  in  the  interests  of  the  organization 

•  Positive  incentive-based  practices  (positive  incentives,  for  short):  workforce  management 
practices  that  encourage  employees  to  act  in  the  interests  of  the  organization 

While  a  balanced  approach  focuses  on  a  combination  of  positive  and  negative  incentives,  positive 
incentives  have  been  studied  extensively  in  the  modern  era  [Levy  2013,  Smither  2009].  By  far, 
most  of  this  research  focuses  on  the  benefits  of  this  approach  for  improved  productivity,  perfor¬ 
mance,  and  retention,  including  a  relatively  recent  focus  in  an  area  called  “positive  psychology” 
[Seligman  2012].  While  much  of  the  recent  practice-based  literature  focuses  on  a  concept  called 
“work  engagement,”  researchers  have  noted  that  this  concept  is  actually  a  conflation  of  a  lot  of 
previously  established  social  science  theories  and  domains  of  research  [Meyer  2013]. 

We  believe  there  are  three  dimensions  along  which  we  can  align  an  employee’s  interests  with 
their  employer’s  interests:  the  employee’s  job ,  their  organization,  and  the  people  they  work  with. 
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•  Job  Engagement  involves  the  extent  to  which  employees  are  excited  by  and  absorbed  in  their 
work.  Strengths-based  management1  and  professional  development  are  practices  known  to 
boost  employee  job  engagement.  Measurement  scales  for  employee  engagement  have  a  con¬ 
siderable  history,  including  their  use  by  both  the  U.S.  Government  [OPM  2015]  and  academic 
researchers  [Schaufeli  2004a]. 

•  Perceived  Organizational  Support  involves  the  extent  to  which  employees  believe  their  or¬ 
ganization  values  their  contributions,  cares  about  their  well-being,  supports  their  socio-emo- 
tional  needs,  and  treats  them  fairly.  Here,  programs  promoting  flexibility,  work/family  bal¬ 
ance,  employee  assistance,  alignment  of  compensation  with  industry  benchmarks,  and 
constructive  supervision  that  attends  to  employee  needs  can  boost  perceived  organizational 
support.  Extensively  validated  measures  have  been  widely  used  since  the  1980s  [Eisenberger 
1986],  culminating  in  a  seminal  publication  that  summarizes  that  research  in  book  form  [Ei¬ 
senberger  2011]. 

•  Connectedness  at  Work  involves  the  extent  to  which  employees  want  to  interact  with,  trust, 
and  feel  close  to  the  people  they  work  with.  Practices  involving  team  building  and  job  rota¬ 
tion  can  boost  employees’  sense  of  interpersonal  connectedness.  One  important  scale  is  the 
one  associated  with  Self  Determination  Theory  (SDT),  in  particular,  the  relatedness  aspects  of 
the  Basic  Psychological  Needs  at  Work  Scale  [Brien  2012].  Another  scale  is  associated  with 
the  Theory  of  Belongingness  [Malone  2012]. 

Although  there  has  been  extensive  research  in  these  areas  that  demonstrate  their  value  in  terms  of 
employee  satisfaction,  commitment,  performance,  and  retention  [Levy  2013],  a  related  body  of 
research  exists  that  helps  to  determine  their  value  for  reducing  insider  threats. 

Literature  with  a  strong  connection  to  our  research  includes  studies  that  show  that  positive  em¬ 
ployee  attitudes  about  their  work  are  linked  to  reduced  counterproductive  work  behaviors.  Coun¬ 
terproductive  work  behaviors  include  malicious  insider  threat  behaviors  as  well  as  other  less  egre¬ 
gious,  but  still  counteiproductive,  behaviors.  A  well-established  body  of  research  on 
psychological  contracts  that  employees  (often  implicitly)  have  with  their  organizations  can,  if 
breached,  serve  as  the  reason  for  negative  attitudes  and  behaviors  by  employees  [Rousseau  1995, 
Restubog  2015]. 

Research  on  psychological  contract  breaches  aligns  with  modeling  research  conducted  at  the  SEI 
that  shows  patterns  of  insider  IT  sabotage  rooted  in  the  insider’s  unmet  expectations  [Cappelli 
2012],  Generally,  counterproductive  work  behaviors  are  found  to  be  negatively  correlated  with 
the  following: 

•  job  engagement  (e.g.,  [Sulea  2012,  Ariani  2013]) 

•  connectedness  at  work  (e.g.,  [Sulea  2012]) 

•  perceived  organizational  support  (e.g.,  [Bordia  2008,  Sulea  2012,  Shoss  2013]) 

•  organizational  citizenship  behavior  (e.g.,  [Ariani  2013]) 

•  conscientiousness  (e.g.,  [Shoss  2013]) 

•  employee  empowerment  (e.g.,  [Afsheen  2013]) 


Strengths-based  management  focuses  primarily  on  identifying  and  using  an  individual’s  personal  and  profes¬ 
sional  strengths  in  directing  their  career  and  managing  their  job  performance  [Buckingham  2009], 
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Especially  significant  is  that  perceived  organizational  support  is  strongly  correlated  with  organiza¬ 
tional  commitment  [Rhoades  2001]. 

1 .2  Overview  of  the  Report 

Our  research  explores  the  role  of  positive  incentives  on  insider  threat  behaviors  through  incident 
analysis  and  an  organizational  survey. 

Section  2  describes  the  analysis  of  three  incidents  of  intentional  harm  caused  by  disgruntled  insid¬ 
ers  to  better  understand  the  potential  role  of  job  engagement,  perceived  organizational  support, 
and  co-worker  connectedness  in  the  context  of  the  insider’s  decision  to  attack.  Based  on  the  need 
to  narrow  the  organizational  survey,  the  results  of  our  admittedly  limited  incident  analysis,  and 
some  supporting  literature,  we  focus  our  survey  work  on  perceived  organizational  support  and  re¬ 
lated  issues  of  organizational  justice. 

Section  3  describes  the  survey  method  employed  and  the  analysis  of  the  results  of  twenty-three 
respondents. 

Section  4  models  the  disgruntled  insider  threat  problem  as  it  relates  to  dissatisfaction  with  the  em¬ 
ploying  organization  and  the  potential  benefits  associated  with  positive  incentives  that  improve 
perceived  organizational  support  and  justice. 

As  a  starting  point  for  organizations  to  understand  their  options  for  using  positive  incentives  as 
part  of  their  insider  threat  programs,  Section  5  provides  an  outline  of  workforce  management 
practices  based  on  positive  incentives. 

Finally,  Section  6  summarizes  our  results  and  describes  avenues  for  future  work.  The  research  de¬ 
scribed  here  is  a  first  step  toward  creating  a  well-grounded  foundation  on  which  insider  threat  pro¬ 
grams  can  establish  a  more  balanced  means  for  insider  threat  reduction. 
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2  Incident  Analysis 


The  purpose  of  the  incident  analysis  described  in  this  section  is  to  help  answer  this  question:  To 
what  extent  are  the  interests  of  insider  threat  actors  aligned  with  the  interests  of  the  organization? 
The  previously  described  breakdown  into  three  dimensions — job,  organization,  and  people — sug¬ 
gests  focusing  on  the  following  three  questions: 

1.  Are  insider  threat  actors  disengaged  in  their  job? 

2.  Do  insider  threat  actors  perceive  their  organizations  to  be  supportive? 

3.  Are  insider  threat  actors  disconnected  from  their  co-workers? 

This  section  describes  our  approach  to  analyzing  insider  threat  incidents  and  preliminary  results 
associated  with  three  such  incidents.  We  answer  these  questions  for  each  incident  prior  to  the  start 
of  harmful  activity  and  while  the  harmful  activity  occurred. 

2.1  Method 

Our  research  method  involves  studying  multiple  incidents  of  disgruntlement-spurred  insider 
threats.  We  use  only  public,  non-sensitive  sources  for  each  incident  and  code  the  information 
about  each  incident  so  we  can  make  results  from  our  research  generally  accessible  to  other  re¬ 
searchers.  As  shown  in  Figure  2,  we  code  identified  incidents  along  a  five -point  scale,  ranging 
from  -2  to  +2,  for  each  of  the  three  dimensions — job  engagement,  perceived  organizational  sup¬ 
port,  and  connectedness  with  co-workers. 
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Figure  2:  Overview  of  the  Five-Point  Scales  for  Interest  Alignment 


As  might  be  expected,  the  high  end  of  the  scale  (+2)  indicates  the  most  positive  assessment  of  the 
dimension,  whereas  the  low  end  of  the  scale  (-2)  indicates  the  most  negative  assessment.  The  mid¬ 
dle  point  on  the  scale  (0)  indicates  a  rather  neutral  assessment,  although  this  assessment  does  not 
indicate  a  desired  situation  for  either  the  organization  or  the  person  involved.  The  points  between 
the  neutral  point  and  the  high  and  low  ends  (+1  and  -1,  respectively)  indicate  exactly  that — an  as¬ 
sessment  that  is  less  extreme  than  the  end  point,  but  more  extreme  than  the  neutral  point. 
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To  provide  coders  with  a  greater  sense  of  the  points  along  the  scale,  we  provided  an  example  at 
each  point  and  provided  previously  developed  survey  questions  used  in  established  assessments 
for  each  dimension.  The  final  scales  used  for  each  dimension — with  examples  and  clarifying 
questions — are  elaborated  in  Appendix  B. 

While  the  information  sources  for  each  incident  are  usually  not  rich  enough  to  answer  the  estab¬ 
lished  survey  questions  individually,  they  can  help  to  get  a  sense  of  where  along  the  five -point 
scale  the  information  that  we  do  have  puts  the  insider’s  behaviors  and  attitudes.  Admittedly,  this 
activity  is  relatively  inexact.  However,  we  can  increase  the  accuracy  and  consistency  of  the  cod¬ 
ing  process  by  requiring  documentation  of  the  coder’s  justification  for  their  rating  on  the  scale  for 
each  dimension.  In  addition,  since  the  insiders’  ratings  may  vary  over  time,  we  provide  ratings 
along  the  five  points  at  each  of  three  contiguous  time  periods  during  the  incident  lifecycle.  This 
range  of  ratings  provides  a  sense  of  the  evolution  of  the  subjects’  attitudes  and  behaviors  over 
time. 

2.2  Incident  Analysis  Results 

We  rated  three  incidents  where  intentional  harm  perpetrated  by  disgruntled  insiders  took  place.2 
Figure  3  provides  an  overview  of  our  analysis  of  each  of  the  three  incidents  rated  along  the  five- 
point  scale.  Each  of  the  three  dimensions  are  represented  as  separate  graphs,  and  each  of  the  three 
time  periods  are  indicated.  The  raters  for  each  case  also  provided  their  assessment  of  the  overall 
score  for  each  dimension. 


As  shown,  Perceived  Organizational  Support  was  negative  in  all  three  incidents,  while  Job  En¬ 
gagement  was  negative  in  only  two  of  the  three  (Case2  and  Case3)  and  Connectedness  at  Work 
was  negative  in  only  one  of  the  three  (Case2). 


Perceived 

Organizational 

Support 


Job 

Engagement 


Connectedness 
at  Work 


Figure  3:  Incident  Analysis  Overview 


This  report  does  not  identify  the  insiders  involved  in  the  incidents  rated. 
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This  finding  was  a  bit  suiprising.  As  we  looked  at  the  incidents,  it  seemed  like  the  individual  in 
Casel  could  be  fairly  engaged  in  their  job  while  conducting  activities  counter  to  the  organization. 
Even  more  surprising,  the  individuals  in  Case2  and  Case3  maintained  fairly  good  relations  with 
their  co-workers  while  engaging  in  a  betrayal  of  their  organization  and  country. 

While  it  is  impossible  to  draw  general  conclusions  from  this  small  number  of  cases,  the  results  do 
suggest  that  perceived  organizational  support  may  be  more  central  to  our  hypothesis  that  positive 
incentives  can  reduce  insider  threats.  Of  the  three  dimensions  that  we  studied,  the  strongest  nega¬ 
tive  correlation  with  counterproductive  work  behaviors  found  in  the  literature  was  also  linked  to 
perceived  organizational  support.  This  combination  of  evidence  argues  in  favor  of  focusing  on 
that  dimension  in  our  survey  work,  especially  since  we  needed  to  limit  the  number  of  questions  in 
our  survey  to  ensure  an  adequate  response  rate. 

The  last  aspect  of  our  analysis  was  to  evaluate  the  attitudes  of  the  insider  threat  actors  as  they 
changed  over  time.  There  was  some  fluctuation  over  time  in  all  three  cases,  but  there  was  a  defi¬ 
nite  trend  downward  on  all  three  dimensions  through  the  early,  middle,  and  late  periods  of  the  in¬ 
cidents.  This  trend  becomes  more  apparent  in  Figure  4,  which  shows  the  sum  of  each  dimension 
across  the  three  cases. 


early  middle  late 


Figure  4:  Over  Time  Behavior  Along  Three  Dimensions 
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3  Organizational  Survey 


The  goal  of  this  survey  was  to  understand  what  types  of  organizational  management  practices  im¬ 
pact  the  frequency  of  cyber-related  workplace  theft  and  sabotage. 

The  foundational  research  on  the  topic  of  workplace  aggression/crime  and  related  topics  bal¬ 
looned  from  roughly  the  1960s  to  the  early  2000s.  This  corpus  of  work  evaluated  possible  ante¬ 
cedents  and  consequences  of  workplace  aggression  and  crime,  often  collapsed  into  categories 
called  “counterproductive  workforce  behaviors”  or  “CWBs.”  However,  it’s  difficult  to  generalize 
these  findings  to  the  digital  age  wherein  different  machinations  of  theft  and  sabotage  have 
evolved. 

Pre-digital  age  discoveries  might  be  unique  to  a  particular  time  period  or  generation  of  workers, 
which  we  call  a  “cohort  effect”  [Shadish  2002],  and  this  effect  poses  a  research  gap.  Because  the 
digital  age  engendered  workplace  surveillance,  performance  monitoring,  etc.  that  employees 
sometimes  maladapted  to  (loneliness,  paranoia,  isolation,  etc.),  we  are  cautious  about  inferring 
that  antecedents  to  cyber-related  workplace  aggression/crime  is  part  of  the  same  theoretical  frame¬ 
work  as  pre-digital  CWBs. 

Little,  if  any,  theoretical  research  has  compared  pre-digital  and  post-digital  CWBs  and  their  ante¬ 
cedents.  This  survey  work  attempts  to  understand  the  relationship  between  antecedents  discovered 
in  the  foundational  research  and  cyber-related  CWBs  or  CY-CWBs.  CY-CWBs  are  those  digital 
counterproductive  workplace  behaviors  that  are  deleterious  to  the  productivity  and  well-being  of 
fellow  employees  within  an  organization. 

3.1  Background 

A  subset  of  “psychometrics”  includes  validated  inventories  used  commercially  or  in  academia  to 
measure  psychological  phenomenon  of  interest.  Most  psychometrics  are  designed  and  vetted  with 
various  scripted  reliability  and  validity  metrics  to  demonstrate  their  robustness  in  the  field.  Thus, 
it  makes  sense  to  use  existing  psychometrics  to  measure  antecedents  of  interest.  However,  be¬ 
cause  no  psychometric  existed  for  measuring  the  frequency  of  cybersecurity-related  CWBs,  we 
generated  our  own  CY-CWBs  inventory  for  the  purpose  of  this  study. 

To  generate  CY-CWBs,  we  reviewed  prior  conceptual  and  theoretical  frameworks  of  counterpro¬ 
ductive  workplace  behaviors,  chose  the  most  comprehensive  framework  [Buss  1961],  and  au¬ 
thored  new  cyber-related  questions  reflecting  each  dimension  in  Buss’s  framework.  Each  of  the 
40+  matrix  items  reflected  Buss’  CWB  dimensionality;  however,  we  needed  to  choose  a  subset  of 
matrix  items  for  scoping  purposes  or  our  participants  would  be  taking  a  lengthy  survey. 

From  our  prior  SEI  insider  threat  research,  two  prominent  dimensions  emerged — sabotage  and 
theft — and  those  became  the  two  CY-CWB  dimensions  of  interest.  Section  3.2,  Method,  discusses 
the  detailed  process  of  generating  CY-CWB  questionnaire  items. 
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The  antecedents  of  CWBs  are  well  documented  but  conceptually  disorganized.  One  of  the  most 
notable  antecedents  is  perceived  injustice ,3  and  when  coupled  with  a  lack  of  perceived  organiza¬ 
tional  support ,4  employees  report  a  reduced  sense  of  socio-emotional  and  intellectual  well-being. 
Other  antecedents  include  the  following: 

•  lack  of  supervisor  trust  [Konovsky  1994] 

•  low  levels  of  work  engagement  [Saks  2006,  Schaufeli  2004b,  Shantz  2014,  Sonnentag  2003] 

•  abusive  leadership  [Restubog  2011,  Shoss  2013] 

•  high  workload  [Schaufeli  2004b] 

•  supportive  organizational  climate  [Luthans  2008] 

•  lack  of  worker  autonomy  [Baard  2004,  Gagne  2005] 

Some  of  the  comorbid  emotional  states  include  the  following: 

•  anger  [Cropanzano  1989,  Westman  2001] 

•  aggression  [Bowling  2011,  Neuman  2005,  Penney5] 

•  negative  mood  in  general  [Bushman  2001,  De  Quervain  2004,  Penney] 

•  emotional  exhaustion  [Krischer  2010] 

•  stress  [Vermunt  2005] 

You  may  be  overwhelmed  by  the  array  of  factors  and  no  less  relieved  to  know  that  the  list  above 
is  far  from  comprehensive.  A  few  meta-analytic  papers  [Dalai  2005,  Kurtessis  2015,  Rich  2010, 
Saks  2006,  Simpson  2009]  have  attempted  to  organize  these  factors  into  layers  of  antecedents  and 
consequences.  Two  meta-analytic  papers  [Dalai  2005,  Kurtessis  2015]  stress  the  importance  of 
perceived  organizational  justice  and  its  impact  on  perceived  organizational  support,  feelings  of 
job  satisfaction,  and  ultimately  the  frequency  of  counterproductive  workplace  behaviors.  Thus, 
justice,  support,  and  satisfaction  became  the  antecedents  of  interest  but  further  scoping  was 
needed. 

Systematically  paring  down  the  antecedents  list  is  required  to  minimize  the  question  load  on  the 
participant.  In  the  first  stage  of  the  process,  psychometric  quality  was  reviewed  through  metrics  of 
reliability  and  validity  coefficients  that  are  published  in  the  foundational  survey  design  documen¬ 
tation  as  well  as  follow-on  validation  studies.  Our  literature  review  itemized  reliability  and  valid¬ 
ity  coefficients  by  psychometric  name  and  we  ordered  the  list  by  the  magnitude  of  the  reliability 
and  validity  coefficients.  Second,  we  considered  psychometric  type  (e.g.,  metrics  for  cognitive 
abilities,  knowledge,  attitudes,  behavioral  frequencies).  Since  we  cannot  interview  employees 
who  committed  an  insider  threat  behavior,  we  were  forced  to  ask  attitudinal  questions  (e.g.,  “How 
often  do  you  believe  this  behavior  occurs  across  the  organization?”)  of  employees  privy  to  cases 
of  insider  threat.  An  attribute  of  attitudinal  psychometrics  is  the  use  of  agreement  response  scales 
for  each  question.  However,  studies  rarely  publish  response  scale  formatting,  and  we  know  that 


3  [Aquino  2001 ,  Greenberg  1 998,  Bolino  201 5,  Colquitt  2001 ,  Dalai  2005,  Jermier  1 994,  Krischer  201 0,  Kurtessis 
2015,  Moorman  1998,  Saks  2006,  Skarlicki  1997,  Vermunt  2005,  Westman  2001] 

4  [Abas  2015,  Baard  2004,  Ferris  2009,  Gagne  2005,  Kurtessis  2015,  Moorman  1998,  Rhoades  2002,  Rhoades 
2001,  Saks  2006,  Shantz  2014,  Shore  1993,  Wayne  1997] 

5  Penney,  L.  M.;  Spector,  P.  E.;  Goh,  A.;  Plunter,  E.  M.  &  Turnstall,  M.  A  motivational  analysis  of  counterproduc¬ 
tive  work  behavior  (CWB).  Unpublished  manuscript,  University  of  Plouston.  Plouston,  Texas.  2007. 
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response  scale  formats  bias  respondents  implicitly.  Thus,  our  team  documented  the  scale  formats 
with  the  highest  potential  response  bias.  Furthermore,  we  had  to  decide  whether  people  in  our 
sampling  frame  could  speculate  on  fellow  employee  behaviors,  experiences,  and  attitudes.  Specu¬ 
lation  is  uncertain,  so  to  reduce  measurement  error,  we  included  ‘don’t  know’  and  ‘does  not  apply 
to  me’  response  options. 

To  further  pare  down  the  list  of  psychometric  inventories,  we  also  considered  the  statistical  impli¬ 
cations  of  ‘antecedents  predicting  CWBs’  versus  ‘antecedents  explaining  CWBs’.  Given  ournon- 
generalizable  sampling  method  discussed  below,  ‘explanation’  was  more  important  than  ‘predic¬ 
tion’  and  detailed  survey  questions  are  better  suited  for  explanatory  purposes;  whereas  predictive 
inventories  comparatively  include  more  parsimonious  sets  of  generically  worded  items.  The 
tradeoff  we  faced  was  that  detailed  items  can  be  confusing  or  can  exhaust  study  participants, 
lengthening  the  time  to  complete  surveys  and  resulting  in  elevated  non-response  rates,  especially 
when  no  fiscal  incentives  are  used  to  counter  non-response. 

In  sum,  we  removed  job  satisfaction  from  our  antecedent  list  because  of  generic  item  wording. 

We  chose  the  36-item  Survey  of  Perceived  Organizational  Support  (SPOS)  because  of  the  detailed 
questions,  high  number  of  citations,  stable  factor  loading  across  studies,  and  moderately  high  reli¬ 
ability  and  validity.  We  chose  the  organizational  justice  survey  [Moorman  1991]  because  it  was 
the  only  inventory  we  could  find  with  a  published  item  set.  We  generated  our  own  CY-CWB 
items  reflecting  cyber  theft  and  cyber  sabotage. 

This  exploratory  study  focuses  on  the  relationships  between  CY-CWB  s,  organizational  support, 
and  organizational  justice.  Our  research  question  is 

To  what  extent  does  an  organization ’s  support  practices  and  typical  sentiment  of  organiza¬ 
tion  justice  relate  to  the  perceived  frequency  of  cyber-related,  counterproductive  workplace 
behaviors  (CY-CWBs)  across  an  organization ? 

The  results  are  reported  at  the  aggregate  level. 

3.2  Method 

This  section  describes  the  survey  logic,  survey  design,  and  the  two  psychometric  inventories  used. 

3.2.1  Survey  and  Other  Materials 

This  section  first  describes  the  survey  logic  and  then  the  survey  design. 

The  gold  standard  of  survey  study  design  involves  a  matched  sample  of  relevant  demographic  pa¬ 
rameters  of  employees  who  committed  CY-CWBs  to  those  who  did  not  commit  them  within  the 
same  organization.  Then,  measure  the  perceptions  on  organizational  support  and  justice  that  each 
person  experienced  within  each  sample. 

However,  asking  participants  about  CY-CWBs  they  committed  is  problematic  for  two  reasons: 

1.  People  are  unwilling,  for  a  variety  of  reasons,  to  report  transgressions  honestly. 

2.  Some  transgressions  can  warrant  investigation  and  punishment. 

To  relieve  the  burden  of  reporting  their  own  transgressions,  we  instead  asked  insider  threat  profes¬ 
sionals  who  were  privy  to  the  frequency  and  types  of  cyber  insider  threat  cases  (i.e.,  familiar  with 
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those  who  committed  CY-CWB),  to  estimate  the  frequency  of  CY-CWBs  occurrences  within  their 
own  organization.  We  then  asked  these  same  individuals  to  report  on  what  they  believed  to  be  the 
average  levels  of  perceived  organizational  support  and  justice.  In  our  analysis,  we  explored 
whether  a  relationship  existed  among  organizational  support,  justice,  and  beliefs  about  the  fre¬ 
quency  of  CY-CWBs.  One  person  per  organization  responded. 

The  survey  was  built  from  two  existing  psychometric  inventories  (see  brief  overview  below  and 
copies  of  the  inventories  in  Appendix  C)  that  measure  perceived  organizational  support:  the  36- 
item  Survey  of  Perceived  Organizational  Support  or  the  SPOS  [Eisenberger  1986]  and  the  20-item 
perceived  organizational  justice  or  the  OJ  [Moorman  1991]. 

Inventory  items  were  modified  to  use  the  third-person  perspective  because  our  participants  were 
speculating  on  organizational  norms  rather  than  their  own  personal  experience.  The  SPOS  and  OJ 
inventories  were  combined  with  the  CY-CWB  as  a  complete  survey.  Due  to  resource  constraints, 
we  were  unable  to  pilot  test  the  resultant  survey,  conduct  factor  analytics  to  reduce  item  loads  of 
the  CY-CWBs,  or  conduct  alternative  reliability  and  validity  testing.  However,  we  did  conduct 
three  cognitive  task  analyses  with  three  unaffiliated  colleagues  to  ensure  the  item  wording  in  the 
CY-CWBs  reflected  the  dimensions  intended. 

Perceived  Organizational  Support  (POS).  The  survey  of  perceived  organizational  support 
(SPOS)  [Eisenberger  1986]  was  based  on  Organizational  Support  Theory  and  Social  Ex¬ 
change  Theory.  The  SPOS  measures  the  positive  and  negative  perceived  orientation  employ¬ 
ees  feel  the  organization  takes  globally  with  respect  to  employee  contribution  and  welfare. 
The  original  SPOS  included  36  items  comprising  two  latent  variables,  then  was  reduced  to 
17  items  and  2  factors  in  the  short  version.  We  used  the  long  version  to  explore  relationships. 
The  two  latent  variables  are  a  valuation  of  the  employee’s  contribution  and  the  care  of  the 
person’s  well-being.  Known  to  be  high  in  internal  reliability,  the  survey  also  boasts,  to  date, 
1923  citations  [Eisenberger  1986],  which  details  the  derivation  and  validation  of  the  SPOS. 
The  samples  used  to  derive  the  SPOS  were  white  collar  workers  in  manufacturing,  credit  bu¬ 
reau  clerical  workers,  telephone  company  line  workers,  law  firm  secretaries,  bookstore 
bookkeepers  and  clerks,  postal  clerks,  financial  trust  company  employees,  and  high  school 
teachers.  Originally  used  to  predict  absenteeism,  the  SPOS  is  widely  used  to  test  an  array  of 
antecedents  to  and  consequences  of  perceived  organizational  support. 

Organizational  Justice  ( OJ).  This  scale  was  designed  to  be  a  parsimonious  measure  of  three 
latent  variables  of  justice:  distributive  justice,  interactional  justice,  and  procedural  justice. 
Distributive  justice  is  the  degree  to  which  rewards  are  allocated  in  an  equitable  manner 
[Niehoff  1993].  Procedural  justice  is  the  “degree  to  which  job  decisions  included  mecha¬ 
nisms  that  insured  the  gathering  of  accurate  and  unbiased  information,  employee  voice,  and 
an  appeals  process”  [Niehoff  1993,  pp.  537].  Interactional  justice  is  the  manner  in  which  an 
employee  is  treated  during  typical  decision  making  within  an  organization.  Twenty  items 
were  placed  on  a  seven-point  agreement  scale.  The  inventory  reports  reliabilities  for  all  three 
dimensions  above  [Moorman  1991]. 

The  survey  had  six  sections: 

1 .  consent  form 

2.  survey  download 
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3.  SPOS  inventory  (see  copies  of  the  inventories  in  Appendix  C) 

4.  OJ  inventory 

5.  CY-CWB  inventory 

6.  closing  comments 

Participants  were  not  allowed  to  advance  to  the  first  page  of  the  survey  until  they  provided  con¬ 
sent.  Because  we  recognize  the  sensitivity  of  the  topic,  the  next  section  included  an  option  to  al¬ 
low  the  participant  to  download  a  PDF  copy  of  the  survey  for  completion  but  no  paper  copies  of 
the  survey  were  ever  mailed  to  our  team. 

We  then  asked  the  participants  for  the  number  of  years  worked  in  the  current  organization.  The 
inventories  were  then  presented  in  random  order,  a  common  practice  for  reducing  the  impact  of 
nuisance  variables  emerging  from  question  ordering. 

In  the  closing  comments  section,  we  asked  participants  to  list  their  job  title  and  then  asked  for  rec¬ 
ommended  organizational  practices  that  they  believed  would  significantly  reduce  CY-CWBs.  The 
final  page  thanked  the  participant  for  their  assistance  and  no  fiscal  compensation  was  provided. 

The  two  inventories  we  used  (the  third  we  created)  are  described  below: 

3.2.2  Sampling 

The  parameters  of  the  sampling  frame  included  the  following: 

1 .  must  be  at  least  1 8  years  old 

2.  must  be  employed  by  your  current  employer  for  at  least  one  year 

3.  must  possess  knowledge  of  employee  management  practices  across  the  organization 

4.  must  have  knowledge  of  the  insider  threat  cases  discovered  within  the  organization 

The  people  who  met  these  parameters  had  a  variety  of  job  titles  in  the  cybersecurity,  HR,  and  le¬ 
gal  professions.  These  individuals  could  be  analysts,  chief  information  security  officers  (CISOs), 
chief  information  officers  (CIOs),  chief  human  resources  officers  (CHROs),  or  legal  counsel. 
Given  the  variability  of  background  professions  and  job  titles,  the  type  of  job  training  to  prepare 
them  for  insider  threat  work  is  moot.  We  have  no  data  on  the  level  of  education  of  these  people  in 
our  sampling  frame. 

We  have  reason  to  believe  that  this  population  is  fairly  rare  and  challenging  to  reach  with  optimal 
sampling  techniques  (random  sampling,  etc.).  Therefore,  a  non-probabilistic  snowball  sampling 
method  was  used  with  an  unknown  number  of  chains.  Many  publications  [Biernacki  1981,  Mag- 
nani  2005,  Spreen  1992]  contest  the  generalizability  of  snowball  sampling  methods  for  hard-to- 
reach  ‘special’  populations;  ‘special’  because  these  people  are  usually  impenetrable  to  outsiders, 
so  response  rates  are  contingent  on  trusted  relationships  [Sudman  1986].  Snowball  sampling  is  a 
non-probability  sampling  method  making  it  impossible  for  generalizable  inference. 

3.2.3  Recruitment  Procedure 

All  participants  were  invited  verbally  during  a  monthly  Open  Source  Insider  Threat  information 
sharing  group  (OSIT)  consortium  call.  The  call  took  place  around  the  first  week  of  August  2016, 
and  the  verbal  invitation  was  followed  by  an  email  invitation  with  hyperlinks  to  the  survey  the 
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same  day.  The  survey  was  available  to  participants  August  7-30,  2016.  Participants  reviewed  the 
consent  form  and  answered  survey  questions.  No  debriefing  was  conducted. 

3.2.4  Analysis  Procedure 

The  survey  instrument  was  designed  with  an  augmented  Likert  scale  of  5  scaled  responses  and  2 
additional  responses.  The  five  point  scale  ranged  from  “1  =  Strongly  Disagree”  to  “5  =  Strongly 
Agree.”  The  two  additional  responses  were  “I  don’t  know”  or  “Does  not  apply  to  me.” 

Due  to  the  limited  sample  size  of  our  survey  (23  valid  organizational  responses  for  55  questions), 
we  were  unable  to  analyze  the  Likert  scale  as  an  ordinal  scale  with  traditional  psychometric  tech¬ 
niques.  We  instead  made  the  following  three  assumptions.  First,  we  assume  that  the  Likert  scale 
values  were  quantitative  (e.g.,  the  difference  between  respondent  A’s  rating  of  a  1  and  a  2  is  pre¬ 
cisely  the  same  as  A’s  rating  difference  between  a  2  and  a  3,  and  so  on  for  all  categories,  all 
scales,  and  all  respondents).  Second,  we  assume  that  the  scale  is  reversible  such  that  questions 
with  negative  valence  (e.g.,  POS  22:  The  organization  fails  to  appreciate  any  extra  effort  from 
me.)  can  be  recoded  to  match  the  positive  valence  questions  by  simply  reversing  the  five  point 
scale.  Finally,  we  assume  that  the  average  of  a  respondent’s  answers  on  all  the  questions  on  a 
given  scale  form  a  consistent  estimate  of  the  respondent’s  position  on  that  scale  (e.g.,  the  average 
of  all  the  POS  questions  is  a  consistent  estimate  of  the  respondents  true  POS  value). 

The  “I  don’t  know,”  “Does  not  apply  to  me,”  and  unanswered  questions  were  coded  as  missing. 
We  used  multiple  imputation  to  generate  five  plausible  values  for  every  missing  response.  We 
used  the  MICE  algorithm  [van  Buuren  2012]  as  implemented  in  the  mice  R  package  [van  Buuren 
201 1]  with  the  random  forest  method  with  a  maximum  50  iterations.  Every  variable  was  included 
in  the  conditional  model  for  every  other  variable. 

Deming  regression  was  used  to  compare  the  organizational  averages  of  the  CWB  scale  against  the 
POS  and  OJ  scales.  The  a  priori  variance  ratios  were  estimated  across  all  five  of  the  multiple  im¬ 
putation  datasets  and  the  regression  was  calculated  for  each  individual  dataset  with  95%  bootstrap 
confidence  intervals  calculated  on  the  slope  parameter  [DiCiccio  1996]  and  then  pooled  across  the 
multiple  imputations. 

3.3  Results 

A  survey  of  members  of  the  Open  Source  Insider  Threat  information  sharing  group  (OSIT) 
yielded  25  responses,  23  of  which  contained  information  about  the  frequency  of  counterproduc¬ 
tive  work  behaviors  in  the  organization.  Of  these  23  responses  only  22%  fully  answered  all  ques¬ 
tions. 

Rates  of  missingness  for  individual  questions  ranged  from  a  maximum  of  65%  missing  (one  ques¬ 
tion,  CWB  20:  Plagiarizing  a  co-worker)  to  a  minimum  of  0%  missing  (24  questions).  The  inter¬ 
quartile  range  of  questions  with  missing  data  spanned  9%  to  26%  missing. 

Exploratory  data  analysis  suggests  that  data  were  not  missing  at  random,  which  further  suggests 
that  our  multiple  imputation  approach  is  necessary  for  unbiased  estimation.  For  example,  the 
choice  of  a  respondent  to  answer  question  CWB  19,  Wiretapping,  was  strongly  associated  with 
the  number  of  years  the  respondent  was  employed  at  the  organization,  with  respondents  choosing 
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“Don’t  Know”  or  leaving  the  question  blank  having  typically  five  years  fewer  experience  than  re¬ 
spondents  who  gave  a  non-missing  response. 

Figure  5  illustrates  the  negative  correlation  between  perceived  organizational  support  and  insider 
misbehavior.  The  resulting  Deming  regression  estimate  of  the  slope  is  -1.04,  with  a  95%  confi¬ 
dence  interval  ranging  from  -2.71  to  -0.41;  therefore,  the  negative  association  is  statistically  sig¬ 
nificant. 


Perceived  Organizational  Support 

Figure  5:  Negative  Correlation  Between  Perceived  Organizational  Support  and  Insider  Misbehavior 

Figure  6  illustrates  the  negative  correlation  between  organizational  justice  and  insider  misbehav¬ 
ior.  The  resulting  Deming  regression  estimate  of  the  slope  is  -0.35,  with  a  95%  confidence  inter¬ 
val  ranging  from  -0.78  to  -0.12;  therefore,  the  negative  association  is  statistically  significant. 


Figure  6:  Negative  Correlation  Between  Organizational  Justice  and  Insider  Misbehavior 

These  results  make  it  clear  that  for  the  organizations  surveyed  more  positive  employee  attitudes 
concerning  organizational  justice  and  support  correlate  with  a  lower  frequency  of  insider  misbe¬ 
havior.  It  is  somewhat  surprising  that  organizational  justice  is  less  negatively  correlated  than  per¬ 
ceived  organizational  support.  One  might  expect  that  unfair  treatment  would  be  a  strong  reason 
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for  insider  misbehavior.  However,  perceived  organizational  support  includes  aspects  of  fair  treat¬ 
ment  as  part  of  the  standard  instrument  for  measurement.  It  also  includes  other  aspects,  such  as 
effective  communication  and  supervisor  supportiveness.  A  plausible  conclusion  to  draw  is  that 
breadth  of  coverage  across  the  various  aspects  of  perceived  organizational  support  is  more  im¬ 
portant  than  in  depth  coverage,  at  least  as  it  relates  to  organizational  justice.  In  Section  5,  we  elab¬ 
orate  workforce  management  principles  and  practice  areas  associated  with  perceived  organiza¬ 
tional  support.  However,  first  we  turn  to  developing  a  simulation  model  for  what  we  know  so  far. 
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4  Model  of  the  Problem 


This  section  describes  a  simulation  model  of  the  problem  associated  with  employees’  dissatisfac¬ 
tion  with  their  employer  and  how  that  dissatisfaction  may  dead  to  disgruntlement-spurred  insider 
threats  such  as  insider  cyber  sabotage,  information  theft,  and  unauthorized  leakage  of  classified 
information. 

4.1  Method 

System  dynamics  helps  analysts  model  and  analyze  critical  behavior  as  it  evolves  over  time 
within  complex  socio-technical  domains.  It  is  one  of  several  modeling  methods  applicable  to  in¬ 
sider  threat  and  has  been  used  extensively  in  that  domain  [Moore  2016,  Cappelli  2012].  Figure  7 
summarizes  the  notation  used  in  our  system  dynamics  model. 

Variable  -  anything  of  interest  in  the  problem  being 
modeled 

Ghost  Variable  -  variable  acting  as  a  placeholder 
for  a  variable  occurring  somewhere  else 

Positive  Influence  -  values  of  variables  move  in  the 
same  direction  (e.g.,  source  increases,  target 
increases) 

Negative  Influence  -  values  of  variables  move  in 
the  opposite  direction  (e.g.,  source  increases,  the 
target  decreases) 

Stock  -  special  variable  representing  a  pool  of 
materials,  money,  people,  or  other  resources 

Flow  -  special  variable  representing  a 
process  that  directly  adds  to  or  subtracts  from 
a  stock 

Cloud  -  source  or  sink  (represents  a  stock 
outside  the  model  boundary) 

Figure  7:  System  Dynamics  Notation 

The  primary  elements  are  variables  of  interest,  stocks  (which  represent  collections  of  resources, 
such  as  dissatisfied  employees),  and  flows  (which  represent  the  transition  of  resources  between 
stocks,  such  as  satisfied  employees  becoming  dissatisfied).  Signed  arrows  represent  causal  rela¬ 
tionships,  where  the  sign  indicates  how  the  variable  at  the  arrow’s  source  influences  the  variable 
at  the  arrow’s  target.  A  positive  (+)  influence  indicates  that  the  values  of  the  variables  move  in  the 
same  direction,  and  a  negative  (-)  influence  indicates  that  they  move  in  opposite  directions. 

A  connected  group  of  variables,  stocks,  and  flows  can  create  a  path  that  is  referred  to  as  a  feed¬ 
back  loop.  At  this  stage  in  our  modeling  effort,  we  have  not  identified  any  significant  feedback 
loops. 

As  a  convention  in  our  model,  we  format  model  input  variables  with  italics,  bold ,  and  underline 
since  these  variables  can  be  dynamically  manipulated  during  model  execution. 
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4.2  The  Model 


The  core  stocks  and  flows  associated  with  an  employee’s  changing  satisfaction  with  their  employ¬ 
ing  organization  is  shown  in  Figure  8.  We  take  a  simple  view  that  employees  are  either  satisfied 
with  the  organization  or  not,  represented  as  the  two  primary  stocks  involved.  We  assume  that 
newly  hired  employees  may  be  dissatisfied  with  the  organization,  perhaps  as  a  result  of  a  negative 
hiring  or  onboarding  process. 

The  user-settable  variable  percent  satisfied  at  hire  represents  the  percentage  of  those  hired  that 
are  satisfied.  Of  course,  satisfied  employees  can  become  dissatisfied  at  some  rate;  percent  becom¬ 
ing  satisfied  represents  the  percentage  per  month  of  satisfied  individuals  that  become  dissatisfied. 
Likewise,  there  is  a  user-settable  percentage  per  month  of  dissatisfied  individuals  that  become  sat¬ 
isfied;  however,  we  assume  there  is  some  percentage  of  the  workforce  that  is  perpetually  dissatis¬ 
fied  that  is  not  included  in  the  flow  of  employees  becoming  satisfied. 

Finally,  while  employees  leaving  the  organization  may  be  either  satisfied  or  not,  we  expect  a 
larger  percentage  of  dissatisfied  employees  will  leave.  The  next  section  discusses  factors  involved 
with  setting  the  variables  in  the  execution  of  the  model  based  on  existing  data  and  our  project 
analysis. 


Figure  8:  Core  Stocks  and  Flows  in  the  Organizational  Context 


Figure  9  extends  the  model  to  include  the  potential  for  dissatisfied  employees  to  become  disgrun¬ 
tled  and  potentially  become  insider  threat  actors.  We  separate  the  stock  of  disgruntled  insiders 
from  the  stock  of  those  that  actually  go  on  to  cause  insider  threat  incidents.  Once  someone  causes 
an  incident,  there  is  no  turning  back;  they  may  be  stopped  from  causing  further  harm,  but  they 
will  forever  be  seen  as  insider  threat  actors  by  their  employers. 

However,  those  that  are  only  disgruntled  may  get  pulled  back  from  the  brink  either  through  their 
departure  from  the  organization  or  by  their  re-engagement  in  the  mission  of  the  organization.  We 
make  the  following  simplifying  assumptions: 
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•  The  rate  of  re-engagement  is  proportional  to  the  rate  of  dissatisfied  employees  becoming  sat¬ 
isfied. 

•  The  rate  of  departure  is  proportional  to  the  rate  of  termination  of  dissatisfied  employees. 

While  these  assumptions  are  debatable,  they  seem  reasonable  for  an  initial  approximation.  We 
discuss  the  interpretation  and  measurement  of  various  aspects  of  the  model  in  the  next  section. 


Figure  9:  Emerging  Physics  of  Organization  Dissatisfaction  and  the  Disgruntled  Insider 
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4.3  Model  Settings 


The  model  described  in  the  previous  section  raises  the  question  of  what  the  values  should  be  for 
all  of  the  input  variables  during  model  execution.  We  used  the  following  values  in  model  execu¬ 
tion,  at  least  initially: 

•  percent  satisfied  at  hire  =  90% 

•  percent  satisfied  at  termination  =  20% 

•  percent  becoming  satisfied  =  10%/month 

•  percent  becoming  dissatisfied  =  10%/month 

•  percent  of  workforce  perpetually  dissatisfied  =  5% 

•  percent  becoming  disgruntled  =  10%/month 

•  percent  disgruntled  starting  to  attack  =  0.2%/year 

So  how  did  we  derive  these  values?  We  started  by  determining  values  from  previous  research  that 
we  could  use  with  sufficient  confidence  and  then  directed  our  research  to  determine  reasonable 
values  for  other  variables  of  interest.  We  developed  a  preliminary  version  of  this  model  prior  to 
conducting  the  research  described  in  this  report  and  used  it  to  decide  what  additional  data  to  col¬ 
lect. 

As  a  starting  point,  we  reviewed  several  studies  that  are  regularly  conducted  to  assess  employee 
attitudes.  Because  of  our  focus  on  the  U.S.  Government,  a  very  important  study  for  us  is  the  Fed¬ 
eral  Employee  Viewpoint  Survey  Results  [OPM  2015].  This  report  shows  that  employee  satisfac¬ 
tion  within  their  organization  has  been  steady  at  about  55%  over  the  past  several  years.  For  sim¬ 
plicity,  we  assume  these  survey  results  mean  that  55%  of  the  employees  are  satisfied  with  their 
organization  and  45%  are  dissatisfied. 

Finally  a  Gallup  study  has  fairly  consistently  found  that  about  18%  of  the  workforce  is  actively 
disengaged,  which  means  that  the  employee  is  “more  or  less  out  to  damage  their  company”  [Gal¬ 
lup  2013].  This  actively  disengaged  employee  is  also  what  we  refer  to  as  the  disgruntled  insider  in 
the  model.  The  values  for  the  input  variables  listed  above  were  derived  by  a  combination  of  iden¬ 
tifying  plausible  values  and  getting  the  percentages  in  the  previous  paragraph  to  work  out  as  a  re¬ 
sult.  We’ll  describe  the  application  of  sensitivity  (Monte  Carlo)  simulation  in  the  next  section  to 
analyze  the  behavior  of  the  model  over  a  range  of  parameter  values  that  represent  the  uncertainty 
associated  with  those  values. 

4.4  Model  Execution 

Simulation  results  are  described  with  respect  to  a  model  equilibrium,  which  is  shown  in  simula¬ 
tion  graphs  as  a  “baseline”  simulation  run.  The  equilibrium  of  the  model  described  in  this  paper 
ensures  that  the  rate  of  change  of  all  stocks  remains  at  a  constant  value  (possibly  zero).  In  equilib¬ 
rium,  a  model  is  easier  to  experiment  with  since  the  analyst  can  more  easily  determine  how  small 
changes  in  input  affect  the  overall  behavior  of  the  simulation.  Any  change  in  behavior  (as  seen  in 
the  behavior-over-time  graphs)  can  be  attributed  to  that  single  changed  input  and  only  that 
change.  It  is  analogous  in  scientific  experiments  to  keeping  all  variables  constant  (i.e.,  the  inde¬ 
pendent  or  controlled  variables)  except  the  ones  being  studied  (i.e.,  the  dependent  variables). 
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The  baseline  run  of  our  model  represents  an  organization  with  the  percentages  of  the  total  work¬ 
force  described  above:  specifically,  about  55%  of  the  employees  are  satisfied  with  the  organiza¬ 
tion,  45%  are  dissatisfied,  and  18%  are  disgruntled.  These  simulation  results  are  shown  in  Figure 
10  and  Figure  11.  The  simulated  size  of  the  organization  is  somewhat  arbitrary,  but  in  this  execu¬ 
tion  is  about  1,000  people. 
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Figure  1 0:  Employee  Satisfaction  Levels6 
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Figure  1 1:  Employee  Classification  Levels 


This  behavior-over-time  graph  was  generated  using  the  Vensim  modeling  tool.  The  X-axis  for  the  graphs  is 
specified  in  months  (240  months — twenty  years — is  the  duration  of  this  simulation).  The  legend  below  the  graph 
shows  each  variable  and  the  name  of  the  simulation  run  graphed  in  the  format  “variable:  simulation  run".  The 
variable  simulation  runs  are  distinguished  with  a  number  label  (1  and  2  in  Figure  12)  and  in  color  copies  also 
specified  in  the  legend  below  the  graph. 
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Figure  12  shows  the  accumulation  of  insider  threat  incidents  under  the  above  conditions.  The 
baseline  run  shows  about  six  incidents  occurring  over  a  20-year  period.  The  major  factor  here, 
given  our  assumptions,  is  the  variable  percent  disgruntled  starting  to  attack.  This  variable  is  set 
at  0.2%  per  year.  Put  another  way,  every  year  0.002  Disgruntled  Insiders  are  responsible  for  in¬ 
sider  threat  incidents.  In  equilibrium,  there  are  about  150  disgruntled  insiders,  so  this  is  about  one 
incident  every  3-1/3  years,  accumulating  to  about  six  over  20  years. 


Insider  Threat  Incidents 


Insider  Threat  Incidents  :  baseline  - 1 - 1 - 1 - 1 - 1 - 1 - 1 - 1 - 1 

Insider  Threat  Incidents  :  50%  satisfaction  improvement  - 2 - 2 - 2 - 2 — 


Figure  12:  Individuals  Responsible  for  Insider  Threat  Incidents 

The  simulation  run  named  “50%  satisfaction  improvement”  shows  that  the  number  of  insider 
threat  incidents  drops  in  half  over  the  twenty-year  timeframe  of  the  simulation  when  the  rate  of 
employees  becoming  dissatisfied  drops  by  50%  and  the  rate  of  employees  becoming  satisfied  in¬ 
creases  by  50%. 

This  change,  possibly  due  to  workforce  management  practices  to  improve  employee  attitudes 
about  their  satisfaction  with  the  organization,  takes  place  in  the  simulation  at  month  three,  moving 
the  accumulation  of  insider  threat  incidents  off  its  baseline  trajectory  to  fewer  such  incidents.  Of 
course,  the  actual  decline  is  very  sensitive  to  both  the  percentage  improvement  as  well  the  per¬ 
centage  of  disgruntled  employees  starting  to  attack. 
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Figure  13  shows  the  potential  decline  in  incidents  for  various  values  of  these  two  variables  as  a 
three-dimensional  surface. 


Number  of  Insider  Incidents  After  20  Years 
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Figure  13:  Sensitivity  Simulation  Results  on  Insider  Threat  Incidents 

We  can  now  extend  the  model  to  better  understand  the  cost  savings  from  efforts  to  improve  em¬ 
ployees’  satisfaction  with  the  organization.  In  the  upper  right  comer  of  the  model  extension 
shown  in  Figure  14,  we  include  model  variables  to  estimate  the  number  of  counterproductive 
work  behaviors  of  satisfied  employees  and  a  multiplier  of  that  number  of  behaviors  for  dissatis¬ 
fied  employees.  Costs  are  estimated  both  as  a  cost  per  counterproductive  work  behavior,  in  terms 
of  lost  productivity,  and  the  costs  associated  with  insider  threat  incidents. 

The  following  values  are  assumed  for  these  variables  in  our  analysis: 

•  CWB  per  satisfied  =  0.5  CWB/month 

•  multiplier  CWB  rate  per  dissatisfied  =  4.0 

•  cost  per  CWB  =  $500 

•  cost  per  incident  =  $1M 
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Figure  14:  Model  Extension  to  Estimate  Potential  Cost  Savings 
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We  calculate  the  yearly  costs  as  the  simple  sum  of  the  costs  of  productivity  loss  due  to  CWBs  and 
the  costs  due  to  disgruntled  insider  threat  incidents.  We  form  a  yearly  cost  index  based  on  the 
costs  associated  with  no  satisfaction  improvement  (i.e.,  where  percent  satisfaction  improvement 
at  month  3  is  0). 


Figure  15  shows  the  decrease  in  relative  cost  from  the  baseline  due  to  various  levels  of  satisfac¬ 
tion  improvement.  For  example,  with  the  505  satisfaction  improvement  that  we  analyzed  previ¬ 
ously,  we  get  a  25%  reduction  in  yearly  costs  associated  with  egregious  insider  threat  incidents 
and  other  counterproductive  work  behaviors. 


Figure 
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5  Positive  Incentive-Based  Principles  and  Practice  Areas 


We  believe  that  continuing  the  research  started  in  this  report  is  critical  to  establishing  and  manag¬ 
ing  effective  insider  threat  programs.  Our  vision  is  the  extension  of  the  traditional  security  ap¬ 
proach  shown  in  Figure  16.  The  right  side  of  the  figure  depicts  the  traditional  approach  focused  on 
negative  incentives  that  restrict  employees  to  prevent  abuse  and  detects  and  punishes  abuse  when 
it  occurs.  This  approach  is  based  on  a  negative  form  of  deterrence  as  promulgated  in  Deterrence 
Theory,  which  says  that  people  obey  rules  because  they  fear  getting  caught  and  being  punished. 
Restricting,  detecting,  and  punishing  employees  reinforces  the  deterrence  (negative)  of  abuse. 

Our  extension  of  security  through  positive  incentives  is  shown  on  the  left  side  of  the  figure.  In  its 
current  form,  as  supported  by  our  research,  organizational  support  (including  organization  justice) 
is  shown  as  the  foundation  of  positive  deterrence.  With  this  foundation  in  place,  connectedness 
with  co-workers  and  job  engagement  serve  to  strengthen  an  employee’s  commitment  to  the  organ¬ 
ization.  Organization  support  and  connectedness  also  strengthen  overall  engagement  in  a  feedback 
effect. 


This  form  of  positive  deterrence  complements  the  use  of  negative  deterrence  by  reducing  the 
baseline  of  insider  threat  in  a  way  that  can  improve  employees’  satisfaction,  performance,  and 
commitment  to  the  organization.  As  illustrated  in  our  modeling  effort,  fewer  incidents  and  coun¬ 
terproductive  behaviors  reduces  costs  through  fewer  investigations  and  greater  staff  productivity. 
Employing  the  right  mix  and  ratio  of  positive  and  negative  incentives  in  an  insider  threat  pro¬ 
gram  can  create  a  net  positive  for  both  the  employee  and  the  organization — moving  an  insider 
threat  program  from  a  “big  brother”  program  to  a  “good  employer”  program  that  actually  im¬ 
proves  employees’  work  life. 


Balanced  Deterence:  Extending  the  Traditional  Security  Paradigm 
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Figure  1 6:  Extending  the  Traditional  Information  Security  Paradigm 
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Figure  17  provides  a  breakdown  of  practice  areas  relevant  to  developing  and  retaining  staff  to 
achieve  an  organization’s  mission,  with  a  particular  focus  on  positive  incentives.  The  first  two 
branches  off  the  root  node  at  the  left  side  of  the  figure  involve  workforce  management  practices, 
including  hiring  and  retaining  the  appropriate  staff  with  the  right  job  responsibilities  and  ensuring 
that  they  are  positively  motivated  to  execute  responsibilities  that  support  achieving  the  organiza¬ 
tion’s  mission. 

The  third  branch  acknowledges  the  fact  that  employees  can  act  counter  to  the  organization’s  mis¬ 
sion  even  if  they  perform  their  job  well  in  other  respects.  This  branch,  which  traverses  the  red 
node  in  the  figure,  makes  this  partitioning  particularly  appropriate  for  guiding  the  development 
and  refinement  of  insider  threat  programs.  The  second  and  third  branches,  in  combination,  show 
that  practices  can  benefit  the  organization  in  terms  of  employee  satisfaction,  performance,  and  re¬ 
tention  as  well  as  reducing  the  insider  threat. 


Figure  1 7:  Taxonomy  of  Positive  Incentive  Workforce  Management  Practice  Areas 


This  section  describes  practice  areas  that  can  positively  incentivize  employees  in  their  job  and 
work  with  their  employer.  The  first  part  of  this  section  elaborates  the  first  branch  of  Figure  17  that 
has  bold  arrows  that  represent  attracting  the  right  staff. 
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The  second  part  of  this  section  elaborates  the  second  and  the  third  branches  of  Figure  17  that  ter¬ 
minate  with  the  fundamental  practice  areas  associated  with  perceived  organization  support  on  the 
right  side  of  the  figure. 

We  finish  this  section  with  a  discussion  of  organizational  culture.  (Appendix  D  provides  a  graphic 
of  all  the  practice  areas  integrated  together.)  This  discussion  focuses  on  practice  areas  that  pro¬ 
mote  perceived  organizational  support  because,  as  we  previously  described,  we  believe  that 
achieving  this  perception  is  the  foundation  for  other  positive  incentives  an  organization  can  em¬ 
ploy.  Without  that  perception,  all  else  can  be  undermined.  As  a  context  for  our  discussion,  Figure 
17  also  shows  other  factors  that  insider  threat  program  managers  should  consider  when  designing 
their  programs. 

5.1  Hiring  the  Right  Staff 

Needs  assessment  by  hiring 
^  group  to  develop  job  description 
linked  to  mission 

Establish  values  congruence  criteria 

to  determine  alignment  of 
individuals  with  organization  values 

Structured  interviewing  to 

determine  values  congruence  and 
alignment  with  job  description 

Establish  policies  and  procedures  for 
action  when  employee  values  become 
misaligned  with  organization  values 

Figure  18:  Factors  Involved  in  Hiring  the  Right  Staff 

Establishing  and  maintaining  the  right  workforce  is  a  precondition  of  using  positive  incentive- 
based  practices  to  help  align  employee  and  organizational  interests.  Congruence  of  values  among 
employees  and  the  organization  inherently  promotes  perceptions  of  organizational  support  [Eisen- 
berger  2011,  page  87].  While  background  checks  and  reference  checks  are  common  practices, 
some  organizations  may  decide  to  conduct  personality  or  background  tests  to  approximate  a  can¬ 
didate’ s  values  as  a  screening  mechanism  in  the  hiring  process.  For  federal  government  organiza¬ 
tions,  government -sponsored  labs,  and  contractors,  the  ability  to  obtain  a  security  clearance  in¬ 
volving  extensive  background  checks  may  also  be  a  condition  of  employment. 

The  hiring  process  usually  starts  with  a  needs  assessment  conducted  with  the  hiring  group,  possi¬ 
bly  facilitated  by  the  FIR  department.  A  formal  job  description  is  the  likely  work  product  of  the 
needs  assessment,  which  can  be  used  in  structured  interviews  of  job  candidates.  Competency- 
based  interviewing  can  be  a  good  way  to  solicit  and  verify  the  candidate’s  qualifications,  includ¬ 
ing  both  social  skills  and  technical  capabilities.  (See  the  Loominger  competencies  [Jantti  2012].) 

If  the  job  description  reflects  the  skills  and  capabilities  needed  and  its  contribution  to  the  organi¬ 
zation’s  mission,  then  a  good  employee  match  with  the  job  description  should  ensure  the  person’s 
ability  to  fulfil  the  job  responsibilities. 
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Attract  new  staff  to 
execute  job  responsibilities 
linked  to  mission 


There  are  usually  more  options  available  other  than  termination  in  the  case  of  an  employee  who 
becomes  dissatisfied  with  their  job  (e.g.,  adjusting  their  responsibilities  and/or  moving  to  another 
team  within  the  organization).  However,  if  an  employee’s  values  become  misaligned  with  the  or¬ 
ganization’s  values,  lack  of  resolution  may  require  the  person  to  be  respectfully  but  expeditiously 
ushered  out  of  the  organization. 

5.2  Perceived  Organizational  Support 

Perceived  organizational  support  (POS)  involves  the  extent  to  which  employees  believe  their  or¬ 
ganization  values  their  contributions,  cares  about  their  well-being,  supports  their  socio-emotional 
needs,  and  treats  them  fairly.  A  foundation  of  POS  is  Social  Exchange  Theory — a  theory  in  which 
individuals  interact  with  others  and  invest  in  relationships  in  a  way  that  maximally  benefits  them¬ 
selves. 

A  key  concept  is  the  norm  of  reciprocity,  which  has  both  a  positive  and  negative  form.  Positive 
reciprocity  involves  the  actions  of  employees  in  the  interests  of  the  organization  as  a  form  of  re¬ 
payment  (or  obligation  created)  for  favorable  treatment  by  the  organization.  Negative  reciprocity 
involves  misbehaviors  of  employees  performed  because  of  perceived  mistreatment. 

With  these  basic  concepts,  it  is  not  difficult  to  see  how  perceptions  of  organizational  support 
could  influence  insider-threat-related  behaviors.  How  can  an  organization  promote  these  percep¬ 
tions?  As  identified  in  Figure  17  and  elaborated  below,  POS  can  be  encouraged  through  organiza¬ 
tional  justice,  adequate  rewards  and  recognition,  effective  communication,  supportive  manage¬ 
ment,  and  effective  working  conditions  [Eisenberger  2011]. 

Organizational  Justice 


Fair  total 
compensation 
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Past  research  shows  that  employees’  sense  of  fair  treatment  by  the  organization  is  the  strongest 
determinant  of  POS  [Eisenberger  2011].  Organizational  justice  involves  three  types  of  justice: 

•  Distributive  justice  involves  fairness  of  the  distribution  of  resources  within  the  organization, 
either  tangible  forms,  such  as  payment  and  rewards,  or  intangible  forms,  such  as  praise  and 
recognition.  For  example,  aligning  salaries  and  benefits  to  comparable  industry  benchmarks 
can  help  facilitate  perceptions  of  fairness. 

•  Procedural  justice  involves  fairness  of  the  processes  and  procedures  in  the  organization  that 
involve  outcomes  important  to  employees.  Employees’  sense  of  organization  support  comes 
from  the  consistency  and  fairness  of  procedures  involving  performance  appraisals,  for  exam¬ 
ple. 

•  Interactional  justice  involves  the  quality  of  treatment  employees  receive  as  the  organization 
makes  decisions  that  affect  them,  such  as  interpersonal  explanation  of  decisions  in  a  respect¬ 
ful  and  informative  way  (sometimes  called  interpersonal  justice  and  informational  justice,  re¬ 
spectively).  For  example,  perceptions  of  interactional  justice  may  depend  on  a  compassionate 
and  flexible  response  to  an  employee’s  request  for  time  off  to  deal  with  an  ailing  parent  or 
child. 

While  feelings  that  an  employer’s  actions  are  fair  and  equitable  may  come  over  many  years  of  an 
employee’s  experience,  involving  the  employee’s  perception  of  the  organization’s  treatment  of 
their  co-workers  and  self,  these  three  types  of  justice  allow  us,  in  our  research,  to  identify  specific 
practices  that  can  bolster  the  employee’s  overall  sense  of  fairness.  Threads  associated  with  these 
justice  types  appear  in  the  following  sections. 

Adequate  Rewards  and  Recognition 

Advancement  enabled 


Figure  20:  Factors  Involved  in  Adequate  Rewards  and  Recognition 

Some  prominent  research  has  found  that  extrinsic  incentives,  such  as  pay  raises  and  rewards,  can 
reduce  an  individual’s  intrinsic  sense  of  satisfaction  and  fulfillment.  However,  in  general,  that  re¬ 
search  only  weakly  links  the  incentive  with  performance.  Beyond  distributive  justice,  rewards  and 
recognition  that  are  strongly  linked  to  performance  can  boost  an  employee’s  sense  of  competence 
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and  mastery,  which,  as  a  result,  increases  perceptions  of  organizational  support.  Organizational 
rewards  and  recognition,  which  are  discretionary  by  management  or  peers,  have  a  much  greater 
effect  on  feelings  of  organizational  support  than  across-the-board  recognition.  In  addition,  align¬ 
ing  salaries  and  benefits  to  comparable  industry  benchmarks  can  help  facilitate  perceptions  of 
fairness. 

Making  sure  employees  know  about  the  total  remuneration,  including  benefits,  may  be  important 
especially  where  organizations  are  restricted  in  the  salary  levels  that  can  be  offered.  Promotions 
should  also  be  aligned  across  the  organization  with  the  level  of  employee  responsibility  and  per¬ 
formance. 

Problems  can  occur  in  organizations  where  the  primary  means  of  advancement  is  into  manage¬ 
ment  positions  different  from  the  technical  positions  into  which  employees  are  hired.  Manage¬ 
ment  skills  are  a  discipline  of  their  own;  there  is  no  guarantee  that  technical  people  have  such 
skills.  Creating  a  technical  track  of  advancement  separate  from  the  management  track  can  help 
ameliorate  these  problems. 

Effective  Communication 


Staff  feel  the  org 
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Effective  communication 
during  normal  course  of 
business 


Regular  employee 
orientation,  mentoring, 
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their  responsibilities 
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events 


Constructive  guidance  on 
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Conflict  resolution,  grievance,  and 
anonymous  commenting  procedures 
available  and  encouraged 


Figure  21:  Factors  Involved  in  Effective  Communication 


Management’s  effective  communication  with  employees  starts  from  day  one  of  an  employee’s 
tenure  with  new-employee  orientation  and  mentoring  to  help  establish  the  new  employee’s  posi¬ 
tion  in  the  organization.  Effective  communication  supports  an  employee’s  feelings  of  organiza¬ 
tional  support  during  both  good  and  bad  times.  The  greatest  gains  in  perception  of  organizational 
support  come  when  management  voluntarily  acts  in  favorable  ways  to  employees,  rather  than,  for 
example,  as  a  result  of  contractual  agreements  or  regulations.  However,  management  needs  to 
communicate  the  discretionary  nature  of  their  actions  and  the  benefit  to  the  employees.  Managers 
should  facilitate  information  sharing  among  and  within  groups,  especially  because  it  helps  em¬ 
ployees’  work  performance. 
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Reduction  in  POS  due  to  unfavorable  treatment  may  be  lessened  through  effective  communica¬ 
tion.  For  example,  the  organization  may  justify  the  treatment  as  outside  the  organization’s  control, 
diplomatically  explain  the  legitimacy  of  the  treatment,  or,  in  some  cases,  simply  apologize  for  ad¬ 
mitted  poor  treatment  and  rectify  the  matter  in  the  future.  Transparently  accounting  for  manage¬ 
ment  actions  and  conditions  may  be  the  best  way  to  ensure  employees  feel  fairly  treated.  Up-front, 
explicit  expectation  setting  may  also  help  prevent  employees  from  forming  unrealistic  expecta¬ 
tions  that  will  ultimately  fail  to  be  fulfilled. 

Employees’  sense  of  organization  support  also  comes  from  consistency  and  fairness  of  the  proce¬ 
dures  involving  performance  appraisals,  which  rely  on  managers’  effective  communication.  Of 
course,  performance  improvement  plans  may  be  necessary,  but  should  be  conducted  construc¬ 
tively  with  a  focus  on  the  positive  aspects  of  employee  performance,  rather  than  dwelling  on  the 
negative  aspects. 

Fair  grievance  and  conflict  resolution  procedures  should  be  in  place  to  address  issues  as  they 
come  up.  For  individuals  reluctant  to  express  their  concerns,  anonymous  commenting  procedures 
may  serve  a  useful  purpose.  Managers  need  to  both  effectively  communicate  to  and  facilitate 
communication  from  employees. 

Supportive  Management 
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Figure  22:  Factors  Involved  in  Supportive  Management 


For  the  purposes  of  this  report,  supportive  management  deals  mostly  with  interactional  justice  as¬ 
sociated  with  the  treatment  employees  receive  from  their  direct  supervisors.  Supervisors  need  to 
know  their  direct  reports  well  to  make  informed  decisions  regarding  their  work  assignments  and 
daily  work  execution.  Making  sure  employees  have  the  resources  needed  to  execute  task  demands 
is  essential.  Providing  these  resources  and  opportunities  for  professional  development  chosen  by 
the  employee  facilitates  the  employees’  feelings  of  mastery  of  their  domain  of  interest,  job  en¬ 
gagement,  and  support  by  the  organization  in  furthering  their  careers. 
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Employees  that  perform  well  can  be  given  opportunities  to  identify  and/or  participate  in  special 
projects,  as  long  as  those  opportunities  are  available  to  all  employees.  Supportive  supervisors  can 
grant  an  employee  a  level  of  autonomy  commensurate  with  that  employee’s  experience  and  com¬ 
petence.  Employees  interested  in  the  work  of  other  teams  can  be  given  the  opportunity  to  work  on 
joint  projects  or  rotate  to  other  teams  in  the  organization  in  which  they  have  an  interest. 

Supportive  management  also  pertains  to  times  when  the  employee  is  experiencing  difficulties.  As 
mentioned,  perceptions  of  interactional  justice  may  depend  on  a  supervisor’s  compassionate  and 
flexible  response,  for  example,  to  an  employee’s  request  for  time  off  to  deal  with  medical  issues. 
When  problems  arise  with  an  employee’s  performance,  appreciative  inquiry  can  be  a  way  to  focus 
and  build  on  what  is  going  well — a  much  more  self-affirming  and  effective  approach  than  focus¬ 
ing  on  what  is  going  wrong  [Whitney  2010]. 

Workload  balancing  may  be  necessary  in  cases  where  high  performers  are  executing  more  than 
their  fair  share  of  the  work  across  employees  of  comparable  levels.  Another  problem  arises  when 
employees  are  split  across  so  many  projects  that  the  overhead  associated  with  context  switching 
degrades  performance  or  just  makes  the  job  miserable.  Rightsizing  the  number  of  projects  per  per¬ 
son  can  improve  employees’  feelings  of  organizational  support.  The  organization  should  provide 
and  managers  should  encourage  employee  assistance  programs  to  help  with  difficulties  both  per¬ 
sonal  and  professional. 


Effective  Working  Conditions 


Figure  23:  Factors  Involved  in  Effective  Working  Conditions 


Issues  dealt  with  previously,  such  as  management  supportiveness  and  organizational  communica¬ 
tion,  certainly  influence  the  quality  of  the  overall  work  environment.  However,  many  working 
conditions  are  so  ingrained  in  an  organization’s  way  of  doing  things  that  they  may  be  barely  no¬ 
ticeable  to  management.  These  conditions  may  actually  be  part  of  the  culture  of  the  organization, 
which  we  discuss  in  detail  in  the  next  section. 
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Effective  working  conditions  deal  with  issues  that  may  receive  little  attention.  However,  unless 
they  are  explicitly  acknowledged,  they  may  leave  some  employees  feeling  unsupported.  These 
implicit  working  conditions  vary  greatly  by  organization,  but  may  include  bigger  issues,  such  as 
terms  of  employment,  work-hour  or  location  flexibility,  and  work-family  policies,  or  smaller  is¬ 
sues  such  as  acceptable  office  temperature.  Some  of  these  issues  may  be  flexibly  addressed  by 
lower  level  managers.  However,  if  they  are  ingrained  in  culture  and  policy,  they  may  present  big¬ 
ger  obstacles  to  employees.  Organizations  need  to  consider  the  many  potential  issues  involving 
working  conditions  in  creating  an  environment  that  is  supportive  to  employees. 

5.3  Sociocultural  Considerations 

Sociocultural  considerations  at  the  individual,  group,  and  organizational  levels  are  also  pertinent 
to  the  successful  adoption  of  positive  incentives  that  reduce  the  insider  threat.  This  importance  is 
due,  in  part,  to  the  diverse  cultural  backgrounds  of  the  individuals  employed  by  organizations  as 
well  as  the  culture  and  subcultures  of  the  organization  and  its  subunits. 

Today,  the  workforce  employed  by  organizations  in  the  United  States  commonly  includes  individ¬ 
uals  who  were  bom  and  reared  outside  the  city,  state,  and  region  of  the  organization’s  location  as 
well  as  outside  the  United  States.  According  to  the  Bureau  of  Labor  and  Statistics,  in  2014,  16.6% 
of  those  employed  (16  years  old  and  over)  were  foreign  born.7  The  majority,  30.7%,  of  the  for¬ 
eign-born  were  employed  in  the  fields  of  management,  professional,  and  related  occupations. 

The  cultural  diversity  of  the  workforce  has  created  organizations  that  can  be  described  as  being 
culturally  heterogeneous.  This  cultural  heterogeneity  may  require  organizations  to  consider  the 
cultural  composition  of  the  workforce  and  the  culturally  relevant  motivators  that  encourage  em¬ 
ployees  to  act  consistent  with  their  interest.  For  example,  cultural  variations  in  communication, 
concepts  of  time,  and  degree  of  individualism  and  collectivism  adopted  from  their  birth  countries 
may  directly  impact  how  individuals  and  groups  consume  and  interpret  workforce  management 
practices. 

When  communicating,  meaning  and  context  cannot  be  decoupled,  and  it  is  important  for  manage¬ 
ment  to  examine  meaning  and  context  together.  The  high-low  context  continuum  created  by  Hall 
in  1976  considers  both  meaning  and  context,  and  places  cultures  along  a  dimension  spanning  from 
high  context  to  low  context  [Hall  1976].  This  continuum  provides  insights  for  understanding  cul¬ 
turally  significant  differences  between  cultures  and  communication. 

In  high-context  cultures,  cultural  knowledge  is  implicit,  and  contextually  bound  non-verbal  as¬ 
pects  of  communication  are  as  important  as  is  the  silence  that  accompanies  the  explicit  verbal 
code  (i.e..  the  words  themselves).  The  focus  of  the  high-context  culture  is  people  and  relationships 
and,  through  these  relationships,  an  understanding  of  the  non-verbal  aspects  of  communication 
find  meaning.  In  a  low-context  culture,  knowledge  is  explicit  and  communication  in  both  written 
and  spoken  form  is  explicit  and  based  on  direct  statements.  In  low-context  cultures,  the  listener 
understands  the  message  as  it  was  intended  [Hall  1976]. 


http://www.bls.gov/news.release/forbrn.t04.htm 
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How  people  perceive  and  organize  time  and  space  is  a  sociocultural  construct  that  influences  our 
daily  lives — how  we  interact  with  others  and  how  we  perceive  our  past  and  future.  Based  on  eth¬ 
nographic  research,  Hall  proposed  two  variant  solutions  of  how  time  and  space  are  culturally  or¬ 
ganized — monochromic  and  polychromic  time.  Cultures  with  polychromic  tendencies  view  time 
as  something  that  is  fluid,  flexible,  and  adjustable  to  fit  the  needs  of  the  individual  or  group.  In 
monochromic  cultures,  time  is  viewed  as  something  that  is  structured  and  can  be  compartmental¬ 
ized  and  wasted  [Hall  1976].  Tardiness  to  meetings,  pre -meeting  conversation,  or  interruptions  are 
acceptable  in  polychromic  cultures,  while  it  is  considered  unacceptable  in  monochromic  cultures. 

Broad  generalizations  about  the  sociocultural  construct  of  a  country  can  be  found  in  Hofstede’s 
dimensions  of  individuals  and  collectivism.  Individualism  and  collectivism  each  represent  a  set  of 
distinguishing  values;  a  position  on  the  dimension  reflects  a  focus  of  either  “I”  (the  individual)  or 
“we”  (the  collective  group).  On  a  scale  of  0  to  100,  the  most  collectivistic  countries  are  closest  to 
0,  and  those  with  high  individualistic  traits  are  closer  to  100. 

Interpersonal  relationships  and  trust  are  important  to  all  aspects  of  life  in  high-context  and  collec¬ 
tivistic  societies.  Behavior  in  collectivistic  societies  is  governed  by  in-group  norms  with  a  focus 
toward  the  good  of  the  collective  group  versus  the  good  of  the  individual.  Collectivistic  cultures 
value  a  sense  of  self-respect  and  having  the  acceptance  and  approval  of  one’s  peers,  supervisors, 
and  family  members.  Conflict  can  arise  from  the  violation  of  boundaries,  norms  of  group  loyalty 
and  commitment,  reciprocal  obligations,  and  trust.  When  dealing  with  conflicts  or  problems,  high- 
context,  collectivistic  societies  focus  on  the  social  aspects  and  implications  of  a  problem  [Guess 
2004].  According  to  Guess,  members  of  these  societies  value  security  (of  the  group);  are  more 
risk-avoiding;  and  follow  passive,  collaborative,  and  avoidance  strategies. 

In  summary,  when  organizations  design  and  deploy  positive  incentives,  they  should  consider  the 
sociocultural  composition  of  the  workforce.  This  consideration  ensures  their  practices  provide 
motivators  for  individuals  and  groups  with  high-context,  polychromic  collectivistic  tendencies 
and  low-context,  monochromic,  and  individualistic  tendencies.  For  example,  individuals  with 
high-context,  polychromic,  and  collectivistic  tendencies  might  respond  best  to  practices  that  illus¬ 
trate  the  positive  benefits  to  the  group  and  the  long-term  impacts.  Individuals  with  low-context, 
monochromic,  and  individualistic  tendencies  might  respond  best  to  practices  that  illustrate  the 
positive  to  the  individual  and  include  short-  and  long-term  impacts. 
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6  Conclusions  and  Future  Work 


Traditional  insider  threat  management  involves  practices  that  constrain  users,  monitor  their  be¬ 
havior,  and  detect  and  punish  misbehavior.  Such  negative  incentives  attempt  to  force  employees 
to  act  in  the  interests  of  the  organization  and,  when  relied  on  excessively,  can  result  in  negative 
unintended  consequences  that  exacerbate  the  threat  [Moore  2015]. 

Positive  incentives  that  attempt  to  attract  employees  to  act  in  the  interests  of  the  organization  can 
complement  negative  incentives.  We  identified  and  analyzed  three  avenues  for  aligning  the  inter¬ 
ests  of  the  employee  and  the  organization:  job  engagement,  perceived  organizational  support,  and 
connectedness  with  co-workers.  This  report  describes  research  that  provides  evidence  that  a  par¬ 
ticular  set  of  positive  incentives  focused  on  increasing  organizational  support  to  employees  can 
reduce  the  insider  threat. 

In  summary,  this  report  describes  our  research  progress  in  several  areas: 

•  Analyzing  several  high-profile  insider  incidents  for  the  levels  of  job  engagement,  co-worker 
connectedness,  and  perceived  organization  support  evident  during  the  incident  timeline.  Per¬ 
ceived  organizational  support  was  found  to  be  extremely  negative,  while  job  engagement  and 
co-worker  connectedness  were  found  to  be  low,  but  not  necessarily  in  the  extreme.  These  in¬ 
cident  case  studies  suggested  focusing  on  organizational  support  in  our  survey  research. 

•  Conducting  a  survey  of  individuals  responsible  for  establishing  insider  threat  programs  in 
organizations.  Supporting  and  extending  previous  research,  we  found  a  negative  correlation 
between  perceived  organizational  support  and  intentional  (primarily  malicious)  counterpro¬ 
ductive  work  behaviors.  A  somewhat  weaker  negative  correlation  was  also  found  between  or¬ 
ganizational  justice  and  these  behaviors.  The  relationships  were  found  to  be  statistically  sig¬ 
nificant  at  the  95%  confidence  level.  However,  the  exploratory  nature  of  our  initial  analysis 
does  not  permit  us  to  generalize  this  relationship  to  the  larger  population  of  organizations. 

•  Developing  a  simulation  model  that  illustrates  the  value  of  positive  incentives.  We  developed 
a  system  dynamics  model  based  on  published  data  and  simple  (but  arguable)  assumptions 
showing  how  positive  incentives  can  increase  a  program’s  operational  efficiency  with  re¬ 
duced  investigative  costs  and  fewer  incidents  involving  disgruntled  or  exploitive  insiders.  Our 
incident  analysis  and  survey  work  provided  validation  of  the  simulation  model  structure  (i.e., 
the  stock  and  flow  structure  of  the  system  dynamics  model).  We  will  continue  to  calibrate  our 
model  based  on  future  research  and  expect  to  demonstrate  similar  benefits  as  our  work  pro¬ 
gresses. 

Our  research  raises  many  questions  about  how  an  insider  threat  program  can  or  should  incorporate 
positive  incentives  that  improve  employees’  perceptions  of  support  by  the  organization.  Our  re¬ 
search  established  negative  correlations  between  positive  employee  attitudes  regarding  organiza¬ 
tional  support  and  frequency  of  cyber-related  insider  misbehavior  for  the  organizations  surveyed; 
however,  more  research  is  needed  to  demonstrate  that  those  positive  attitudes  cause  less  misbe¬ 
havior  and  that  the  survey  results  generalize  to  the  larger  population  of  organizations  establishing 
insider  threat  programs. 
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In  parallel  with  the  above  foundational  research,  we  plan  to  work  with  individual  organizations  to 
focus  on  what  we  believe  to  be  the  key  to  a  successful  insider  threat  program:  identifying  the  mix 
of  positive  and  negative  incentives  that  creates  a  net  positive  for  both  the  employee  and  the  organ¬ 
ization.  This  report  elaborates  candidate  positive  incentive-based  principles  and  practice  areas,  but 
this  is  just  a  first  step.  The  challenge  is  that  people  respond  to  incentives  differently  depending  on 
the  culture  of  the  organization,  the  nature  of  their  job,  and  their  personality.  Fortunately,  existing 
theory  provides  insight  into  these  differences  and  help  organizations  build  a  transition  process  to 
develop  the  right  balance  of  positive  and  negative  incentives.  Such  incentives  promote  employee 
satisfaction,  performance,  and  retention,  and  ultimately  help  organizations  become  more  effective 
at  reducing  the  insider  threat. 
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Appendix  A  Research  Landscape 


Figure  24  provides  an  overview  of  our  research  in  the  context  of  related  research,  development, 
and  practice.  In  general,  the  top  left  provides  a  two-dimensional  partition  that  focuses  on  the  HR 
domain,  while  the  bottom  right  provides  a  two-dimensional  partition  that  focuses  on  the  cyberse¬ 
curity  domain.  Our  research  is  positioned  at  the  nexus  of  these  two  domains  with  a  focus  on  early- 
stage  disincentivization  of  insider  threats  using  positive  incentives  that  benefit  both  the  employee 
and  the  organization. 
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Figure  24:  Research  Landscape 


The  partition  in  the  top  left  of  Figure  24  breaks  the  space  by  practice  type  and  practice  target. 
Along  the  X  axis,  practice  type  is  split  into  negative  and  positive  incentives.  Along  the  Y  axis,  the 
target  of  the  practice  addresses  whether  the  primary  intent  is  improving  employee  productivity  or 
performance  versus  decreasing  counteiproductivity  or  security  threats.  Negative  incentives  em¬ 
body  the  traditional  information  technology  (IT)  security  approach  of  constraining  and  detective 
policies  and  technologies.  They  are  also  the  core  of  old-school  HR  practice  that  focused  on  rules 
for  proper  employee  behavior  and  punishment  for  misbehavior. 

While  a  balanced  approach  focuses  on  a  combination  of  positive  and  negative  incentives,  positive 
incentives  have  been  studied  extensively  in  the  modern  era  [Levy  2013,  Smither  2009].  By  far, 
most  of  this  research  focuses  on  the  benefits  of  this  approach  for  improved  productivity,  perfor¬ 
mance,  and  retention,  including  relatively  recent  focus  in  an  area  called  “positive  psychology” 
[Seligman  2012].  While  much  of  the  recent  practice-based  literature  focuses  on  a  concept  called 
“work  engagement,”  researchers  have  noted  that  this  concept  is  actually  a  conflation  of  a  lot  of 
previously  established  social  science  theories  and  domains  of  research  [Meyer  2013]. 
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The  partition  in  the  bottom  right  portion  of  Figure  24  breaks  the  space  into  malicious  threat  type 
and  stage  of  mitigation.  While  we  do  not  consider  unintentional  threats,  we  represent  the  insider 
(employee)  threat  on  the  right  and  the  external  threat  on  the  left,  including  non-insiders  that  break 
into  an  organization’s  systems  and  masquerade  as  an  authorized  insider.  Along  the  Y  axis  we  in¬ 
clude  everything  from  early-stage  formation  of  threat  actor  motivations  to  late-stage  detection  and 
response  to  harmful  behaviors. 

The  bulk  of  cybersecurity  research,  development,  and  practice  covers  the  external  threat  on  the 
left  side  of  the  partition,  especially  in  the  later  stage.  Relatively  little  research  has  been  conducted 
on  early-stage  mitigation  of  the  external  threat,  as  might  be  investigated  using  soft-power  ap¬ 
proaches  to  cybersecurity  [Nye  2011].  While  traditional  insider  threat  detection  and  response  ap¬ 
proaches  focus  on  later  stage  activities  [Salem  2008],  our  research  focuses  on  the  early-stage  mo¬ 
tivation  formation.  And  rather  than  focusing  on  early-stage  detection  of  at-risk  behaviors,  such  as 
in  other  research  [Brown  2013,  Brdiczka  2012,  Greitzer  2010],  we  focus  on  the  prevention  of  em¬ 
ployee  alienation  by  fostering  positive  attitudes  about  the  organization  and  the  employee’s  work 
experience. 
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Appendix  B  Scales  Used  in  Incident  Coding 


Perceived  Organizational  Support  Scale  [Eisenberger  1986] 
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Figure  25:  Perceived  Organizational  Support  Scale 


To  what  extent  would  the  subject  of  the  incident  agree  or  disagree  with  the  following  statements 
about  the  victim  organization? 

1 .  The  organization  values  my  contribution  to  its  well-being. 

2.  The  organization  appreciates  the  extra  effort  I  give. 

3.  The  organization  would  respond  to  complaints  I  might  have. 

4.  The  organization  really  cares  about  my  well-being. 

5.  The  organization  would  notice  if  and  when  I  do  exceptional  work. 

6.  The  organization  cares  about  my  general  satisfaction  at  work. 

7.  The  organization  shows  concern  for  me. 

8.  The  organization  takes  pride  in  my  accomplishments  at  work. 


CMU/SEI-2016-TR-014  |  SOFTWARE  ENGINEERING  INSTITUTE  |  CARNEGIE  MELLON  UNIVERSITY 
[Distribution  Statement  A:  This  material  has  been  approved  for  public  release  and  unlimited  distribution.] 


39 


Job  Engagement  Scale  [Schaufeli  2006] 
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Figure  26:  Job  Engagement  Scale 


For  the  incident  in  question,  to  what  extent  do  you  agree  or  disagree  with  the  following  statements 
about  the  subject’s  job  in  the  victim  organization?  (Note:  questions  1-3  are  about  the  employee’s 
vigor  in  their  job;  questions  4-6  are  about  the  employee’s  dedication  to  their  job;  and  questions  7- 
9  are  about  the  employee’s  absorption  in  their  job.) 

1 .  At  work,  I  feel  bursting  with  energy. 

2.  At  my  job,  I  feel  strong  and  vigorous. 

3.  When  I  get  up  in  the  morning,  I  feel  like  going  to  work. 

4.  I  am  enthusiastic  about  my  job. 

5.  My  job  inspires  me. 

6.  I  am  proud  of  the  work  that  I  do. 

7.  I  feel  happy  when  I  am  working  intensely. 

8.  I  am  immersed  in  my  work. 

9.  I  get  carried  away  when  working. 
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Connectedness  with  Co-Workers  Scale  [Brien  2012,  Malone  2012] 
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Figure  27:  Connectedness  with  Co-Workers  Scale 


For  the  incident  in  question,  to  what  extent  do  you  agree  or  disagree  with  the  following  statements 
about  the  subject’s  connection  with  co-workers  in  the  victim  organization? 


1. 

2. 

3. 

4. 

5. 

6. 

7. 

8. 

9. 

10. 


When  I’m  with  the  people  from  my  work  environment,  I  feel  understood. 

When  I’m  with  the  people  from  my  work  environment,  I  feel  heard. 

When  I’m  with  the  people  from  my  work  environment,  I  feel  as  though  I  can  trust  them. 
When  I’m  with  the  people  from  my  work  environment,  I  feel  I  am  a  friend  to  them. 
When  I’m  with  the  people  from  my  work  environment,  I  feel  included. 

I  have  close  bonds  with  the  people  from  my  work  environment. 

I  feel  accepted  by  the  people  from  my  work  environment. 

I  have  a  sense  of  belonging  in  my  work  environment. 

I  have  a  place  at  the  table  with  others  in  my  work  environment. 

I  feel  connected  with  others  in  my  work  environment. 
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Appendix  C  Survey  Components 


Organizational  Justice  [Moorman  1991] 

Distributive  Justice 

1 .  My  work  schedule  is  fair. 

2.  I  think  that  my  level  of  pay  is  fair. 

3.  I  consider  my  workload  to  be  quite  fair. 

4.  Overall,  the  rewards  I  receive  here  are  quite  fair. 

5.  I  feel  that  my  job  responsibilities  are  fair. 

Procedural  Justice 

1 .  Job  decisions  are  made  by  the  general  manager  in  an  unbiased  manner. 

2.  My  general  manager  makes  sure  that  all  employee  concerns  are  heard  before  job  deci¬ 
sions  are  made. 

3.  To  make  job  decisions,  my  general  manager  collects  accurate  and  complete  information 
when  requested  by  employees. 

4.  My  general  manager  clarifies  decisions  and  provides  additional  information  when  re¬ 
quested  by  employees. 

5.  All  job  decisions  are  applied  consistently  across  all  affected  employees. 

6.  Employees  are  allowed  to  challenge  or  appeal  job  decisions  made  by  the  general  man¬ 
ager. 

Interactional  Justice 

1.  When  decisions  are  made  about  my  job,  the  general  manager  treats  me  with  kindness  and 
consideration. 

2.  When  decisions  are  made  about  my  job,  the  general  manager  treats  me  with  respect  and 
dignity. 

3.  When  decisions  are  made  about  my  job,  the  general  manager  is  sensitive  to  my  personal 
needs. 

4.  When  decisions  are  made  about  my  job,  the  general  manager  deals  with  me  in  a  truthful 
manner. 

5.  When  decisions  are  made  about  my  job,  the  general  manager  shows  concern  for  my 
rights  as  an  employee. 

6.  Concerning  decisions  made  about  my  job,  the  general  manager  discusses  the  implications 
of  the  decisions  with  me. 

7.  The  general  manager  offers  adequate  justification  for  decisions  made  about  my  job. 

8.  When  making  decisions  about  my  job,  the  general  manager  offers  explanations  that  make 
sense  to  me. 

9.  My  general  manager  explains  very  clearly  any  decision  made  about  my  job. 
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Survey  of  Perceived  Organizational  Support  (SPOS)  [Eisenberger  1986] 

1 .  The  organization  values  my  contribution  to  its  well-being. 

2.  If  the  organization  could  hire  someone  to  replace  me  at  a  lower  salary  it  would  do  so.  -R8 

3.  The  organization  fails  to  appreciate  any  extra  effort  from  me.  -R 

4.  The  organization  strongly  considers  my  goals  and  values. 

5.  The  organization  would  understand  a  long  absence  due  to  my  illness. 

6.  The  organization  would  ignore  any  complaint  from  me.  -R 

7.  The  organization  disregards  my  best  interests  when  it  makes  decisions  that  affect  me.  -R 

8.  Help  is  available  from  the  organization  when  I  have  a  problem. 

9.  The  organization  really  cares  about  my  well-being. 

10.  The  organization  is  willing  to  extend  itself  to  help  me  perform  my  job  to  the  best  of  my 
ability. 

1 1 .  The  organization  would  fail  to  understand  my  absence  due  to  a  personal  problem.  -R 

12.  If  the  organization  found  a  more  efficient  way  to  get  my  job  done  they  would  replace  me. 
-R 

13.  The  organization  would  forgive  an  honest  mistake  on  my  part. 

14.  It  would  take  only  a  small  decrease  in  my  performance  for  the  organization  to  want  to  re¬ 
place  me.  -R 

15.  The  organization  feels  there  is  little  to  be  gained  by  employing  me  for  the  rest  of  my  ca¬ 
reer.  -R 

16.  The  organization  provides  me  little  opportunity  to  move  up  the  ranks.  -R 

17.  Even  if  I  did  the  best  job  possible,  the  organization  would  fail  to  notice.  -R 

18.  The  organization  would  grant  a  reasonable  request  for  a  change  in  my  working  condi¬ 
tions. 

19.  If  I  were  laid  off,  the  organization  would  prefer  to  hire  someone  new  rather  than  take  me 
back.  -R 

20.  The  organization  is  willing  to  help  me  when  I  need  a  special  favor. 

2 1 .  The  organization  cares  about  my  general  satisfaction  at  work. 

22.  If  given  the  opportunity,  the  organization  would  take  advantage  of  me.  -R 

23.  The  organization  shows  very  little  concern  for  me.  -R 

24.  If  I  decided  to  quit,  the  organization  would  try  to  persuade  me  to  stay. 

25.  The  organization  cares  about  my  opinions. 

26.  The  organization  feels  that  hiring  me  was  a  definite  mistake.  -R 

27.  The  organization  takes  pride  in  my  accomplishments  at  work. 

28.  The  organization  cares  more  about  making  a  profit  than  about  me.  -R 

29.  The  organization  would  understand  if  I  were  unable  to  finish  a  task  on  time. 

30.  If  the  organization  earned  a  greater  profit,  it  would  consider  increasing  my  salary. 

3 1 .  The  organization  feels  that  anyone  could  perform  my  job  as  well  as  I  do.  -R 

32.  The  organization  is  unconcerned  about  paying  me  what  I  deserve.  -R 

33.  The  organization  wishes  to  give  me  the  best  possible  job  for  which  I  am  qualified. 

34.  If  my  job  were  eliminated,  the  organization  would  prefer  to  lay  me  off  rather  than  transfer 
me  to  a  new  job.  -R 

35.  The  organization  tries  to  make  my  job  as  interesting  as  possible. 

36.  My  supervisors  are  proud  that  I  am  a  part  of  this  organization. 


R  indicates  that  the  item  is  reverse  scored. 
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CY-CWB 


On  average,  how  frequently  does  each  non-accidental  employee  behavior  occur  at  your  organization?  Please  estimate  if  you  cannot 
remember. 

Occasionally  =  at  least  once  a  year 
Sometimes  =  at  least  once  every  other  month 
Often  =  at  least  once  a  week 
All  the  time  =  at  least  once  daily  * 

In  your  opinion,  how  often  does  this  employee  behavior  typically  occur  at  your 
organization? 


Purposely  damaging  a  piece  of  equipment  that  the  organization 
owns.  * 

[  —  Please  Select  -- 

Purposely  vandalizing  a  company  website.  * 

[  —  Please  Select  -- 

Purposely  took  a  non-trivial  item(s)  valued  over  $25  without 
permission.  * 

[  —  Please  Select  --  pj 

Purposely  reading  sensitive  documents  not  authorized  to  read.  * 

[  —  Please  Select  —  pj 

Purposely  damaging  someone's  work  product  (reports,  repository, 
blogs,  etc).  * 

[  —  Please  Select  --  [  ▼ 

Purposely  inhibiting  a  coworker's  progress.  * 

[  -- Please  Select  —  p" 

Purposely  logging  into  an  assigned  work  computer  during  business  hours  to  appear 
as  if  working  but  not  actually  working.  * 

[  -- Please  Select  —  pj 

Purposely  producing  work  that  was  low  quality  when  high  quality  work  was  easy 
and  possible.  * 

[  -- Please  Select --  pj 

Purposely  installing  software  to  harm  organization.  • 

[  --  Please  Select  —  p 

Purposely  sending  an  email  to  harm  another  person's  computer.  * 

[  —  Please  Select  --  |  ▼  | 

Purposely  providing  coworkers  with  sensitive  information  for  which  they 
were  not  authorized.  * 

[  —  Please  Select  —  pj 

Purposely  and  inappropriately  transmitting  employer's  proprietary 
information  internally.  • 

[  --  Please  Select  - 

Purposely  taking  physical  or  electronic  copies  of  employer's  proprietary 
information  upon  resignation.  * 

|  --  Please  Select  —  pj 

Purposely  mislabeling  the  sensitivity  of  emails  and/or  documents.  • 

[  --  Please  Select  - 

Purposely  violating  an  acceptable-use  policy  for  tools  and  technology.  * 

[  —  Please  Select  --  ^ 

Purposely  violating  a  known  security  policy.  * 

|  -  Please  Select  -- 

Purposely  accessing  the  organization’s  network  remotely  in  an  unauthorized  way.  * 

|  --  Please  Select  —  pj 

Purposely  transmitting  organizational  proprietary  information  externally  without 
authorization.  * 

|  --  Please  Select  --  ^ 

Purposely  committed  an  unauthorized  wiretap  on  their  organization's  conversations. 

(wiretap  =  intercepting  telephone  and  internet  communications  in  an  unauthorized  manner) 

[  —  Please  Select  —  ^ 

Purposely  disabled  security  controls  without  authorization.  * 

[  —  Please  Select  --  pj 

Purposely  plagiarizing  a  co-worker's  efforts.  * 

|  --  Please  Select  —  pj 

Purposely  posting  disgruntled  feelings  towards  their  organization  to  the  external  world 
(email,  social  media,  texts,  etc).  * 

|  -  Please  Select  —  w 
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Appendix  D 


Positive  Incentive-Based  Principles  and  Practice  Areas 


Figure  28:  Taxonomy  of  Positive  Incentive  Workforce  Management 
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Figure  29:  Positive  Incentive-Based  Practice  Areas 
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